Back Kucoin

Microsoft Discovers Crypto Clipper Malware Targeting Windows Devices Since February 2026

Kucoin • June 19, 2026

ChainCatcher reports that Microsoft Security Blog announced the discovery of a new cryptocurrency-stealing Trojan named Crypto Clipper by Microsoft’s security research team. Active since February 2026, this malware primarily infects Windows users via malicious .lnk shortcut files distributed through USB devices. Crypto Clipper includes a built-in Tor client that connects to .onion hidden services through a local SOCKS5 proxy to enable covert C2 communication. Its core functionalities include high-frequency clipboard monitoring, theft of mnemonic phrases and private keys, replacement of cryptocurrency transfer addresses, screenshot capture and upload, and execution of remote code commands. Microsoft states that the malware possesses worm-like propagation capabilities: it automatically hides original documents on USB drives and generates malicious shortcuts with identical names, while creating scheduled tasks to maintain persistence. Researchers have detected it as Trojan:Win32/CryptoBandits.A and recommend users disable auto-run for removable devices, restrict script interpreter execution permissions, and closely monitor traffic on localhost:9050 (Tor proxy) and unusual clipboard access patterns.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Crypto Clipper Malware Uses USB and Tor for Stealthy Attacks Microsoft has identified a new cryptocurrency-stealing malware named Crypto Clipper, active since February 2026. This malware spreads primarily through malicious Windows shortcut files (.lnk) on USB drives, targeting Windows users. It employs worm-like behavior, enabling it to propagate itself to other USB devices. The malware monitors clipboard contents for cryptocurrency wallet addresses and can replace them with those controlled by the attacker. Additionally, it captures sensitive information such as seed phrases and private keys, and it can take screenshots of the victim's screen. Communication with its command-and-control server is conducted over the Tor network, making detection difficult. Microsoft recommends focusing on behavioral detection rather than relying solely on traditional signature-based methods. Security teams are advised to monitor for unusual script activity and connections to localhost:9050, which indicates Tor usage. The malware has been classified as Trojan:Win32/CryptoBandits.A. 28 sources 69

Extracted Entities

Microsoft Discovers Crypto Clipper Malware Targeting Windows Devices Since February 2026

The full story

Extracted Entities

Attack Types (3)

Malware (1)

MITRE ATT&CK (7)

Platforms (2)