Back Blogs.Microsoft

Crypto Clipper uses Tor and worm

Blogs.Microsoft •Microsoft Defender Security Research Team and Microsoft Defender Experts • June 17, 2026

Microsoft Threat Intelligence analyzed a cryptocurrency clipper campaign that combines clipboard theft, wallet replacement, Tor-based communications, and worm-like propagation. Beyond stealing cryptocurrency transactions, the malware establishes persistent access and enables follow-on activity through a lightweight backdoor capability.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Crypto Clipper Malware Uses USB and Tor for Stealthy Attacks Microsoft has identified a new cryptocurrency-stealing malware named Crypto Clipper, active since February 2026. This malware spreads primarily through malicious Windows shortcut files (.lnk) on USB drives, targeting Windows users. It employs worm-like behavior, enabling it to propagate itself to other USB devices. The malware monitors clipboard contents for cryptocurrency wallet addresses and can replace them with those controlled by the attacker. Additionally, it captures sensitive information such as seed phrases and private keys, and it can take screenshots of the victim's screen. Communication with its command-and-control server is conducted over the Tor network, making detection difficult. Microsoft recommends focusing on behavioral detection rather than relying solely on traditional signature-based methods. Security teams are advised to monitor for unusual script activity and connections to localhost:9050, which indicates Tor usage. The malware has been classified as Trojan:Win32/CryptoBandits.A. 22 sources 69

Extracted Entities

Crypto Clipper uses Tor and worm

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)