Microsoft Threat Intelligence is warning Windows users about a cryptocurrency clipper strain of malware transmitted via USB drives.\u00a0<\/p>\n
The malware, which has been affecting users since February, steals clipboard data to extract wallet credentials using \u201chigh-frequency clipboard theft, screenshot exfiltration, and wallet-address substitution,\u201d Microsoft said<\/span> Wednesday.<\/p>\n The crypto clipper also hides legitimate files and replaces them with lookalike shortcuts, so victims unknowingly execute malware while a worm component propagates automatically to USB storage devices.\u00a0<\/p>\n This malware<\/span> is insidious because it’s more than just an info stealer, it functions as a backdoor, meaning that attackers can push and execute arbitrary code on infected machines at any time, turning a simple crypto theft into a persistent foothold for ransomware.\u00a0<\/p>\n The execution of this clipper is also notable because it does not depend on a traditional installer or exposed IP-based infrastructure, the Microsoft researchers said.<\/p>\n \u201cThis malware family shows how lightweight, script-based stealers can deliver outsized impact when paired with anonymized communications and runtime tasking.\u201d\u00a0\u00a0<\/p><\/blockquote>\n The malware deploys two obfuscated JavaScript payloads in the Windows Documents directory and creates scheduled tasks for both the worm and stealer components.<\/p>\n The malware also secretly installs a copy of Tor on the victim\u2019s computer but renames it ugate.exe<\/em> to disguise it as something innocent. It then uses the anonymizing Tor network to connect to its malicious operators<\/span> at hidden \u201conion\u201d addresses.<\/p>\n Related: <\/strong><\/em>\u2018TrapDoor\u2019 malware targets crypto dev tools in supply chain attack<\/strong><\/em><\/span><\/p>\n \u201cThe combination of Tor-routed C2, clipboard targeting, screenshot capture and remote code execution gives attackers both immediate monetization paths and continued control over compromised devices,\u201d Microsoft said.\u00a0<\/p>\n Crypto clipper execution flow. Source: Microsoft<\/em><\/p>\n The crypto clipper focuses on \u201chigh-value financial artifacts\u201d from the clipboard, including BIP39 mnemonic seed phrases and Bitcoin and Ethereum private keys.\u00a0<\/p>\n It also replaces copied wallet addresses with attacker-controlled ones across Bitcoin, Tron and Monero<\/span> and takes screenshots every ten seconds for additional context.\u00a0<\/p>\n Microsoft Defender Antivirus detects the malware as Trojan:Win32\/CryptoBandits.A<\/em>.<\/p>\n Microsoft recommended disabling autoplay on removable media, blocking .lnk execution from USB drives, and monitoring for proxy activity and spawned scripts.\u00a0<\/p>\n 2026 has seen a significant escalation in Windows-based crypto stealers. A new Windows malware strain called Lucid Stealer that targets browser extensions and crypto wallets was identified<\/span> earlier this month by the Foresiet Threat Intel Team.\u00a0<\/p>\n Magazine: <\/strong><\/em>The end of anon? AI could unmask crypto\u2019s hidden identities<\/strong><\/em><\/span><\/p>\n<\/div>\n <\/p>\n","protected":false},"excerpt":{"rendered":" Microsoft Threat Intelligence is warning Windows users about a cryptocurrency clipper strain of malware transmitted via USB drives.\u00a0 The malware, which has been affecting users since February, steals clipboard data to extract wallet credentials using \u201chigh-frequency clipboard theft, screenshot exfiltration, and wallet-address substitution,\u201d Microsoft said Wednesday. The crypto clipper also hides legitimate files and replaces …<\/p>\n","protected":false},"author":1,"featured_media":62,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-61","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-crypto-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tTor network used for obfuscation\u00a0<\/h2>\n
![\"\"](\"https:\/\/s3-images.ctmedia.io\/media\/content\/pasted-image-372.jpeg\")
<\/figure>\n<\/p>\nPrivate keys and seed phrases targeted\u00a0<\/h2>\n