Back Feeds.4Sysops

New Crypto Clipper malware uses USB drives and Tor to steal credentials

Feeds.4Sysops •IT News • June 19, 2026

Microsoft has identified a new self-propagating worm named Crypto Clipper that spreads primarily through infected USB drives. The malware monitors system clipboards for patterns matching cryptocurrency wallet addresses or recovery seed phrases. Once it detects sensitive financial data, the tool captures five screenshots within a ten-second window to gather additional context. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Crypto Clipper Malware Uses USB and Tor for Stealthy Attacks Microsoft has identified a new cryptocurrency-stealing malware named Crypto Clipper, active since February 2026. This malware spreads primarily through malicious Windows shortcut files (.lnk) on USB drives, targeting Windows users. It employs worm-like behavior, enabling it to propagate itself to other USB devices. The malware monitors clipboard contents for cryptocurrency wallet addresses and can replace them with those controlled by the attacker. Additionally, it captures sensitive information such as seed phrases and private keys, and it can take screenshots of the victim's screen. Communication with its command-and-control server is conducted over the Tor network, making detection difficult. Microsoft recommends focusing on behavioral detection rather than relying solely on traditional signature-based methods. Security teams are advised to monitor for unusual script activity and connections to localhost:9050, which indicates Tor usage. The malware has been classified as Trojan:Win32/CryptoBandits.A. 28 sources 69

Extracted Entities

New Crypto Clipper malware uses USB drives and Tor to steal credentials

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (3)

Platforms (1)