Microsoft has detected a cryptocurrency clipper malware campaign active since February 2026 that spreads through malicious Windows shortcut (.lnk) files distributed on USB storage devices. The malware monitors and manipulates the clipboard to steal cryptocurrency wallet addresses and seed phrases, replacing them with attacker-controlled alternatives. It enables attackers to steal cryptocurrency, leaving victims unaware.

The malware communicates with its command-and-control server through the Tor network using hidden .onion services and bundles its own Tor client, routing traffic through a local SOCKS5 proxy on port 9050. It does not depend on a traditional installer or exposed IP-based command-and-control infrastructure. The malware also performs screenshot exfiltration and functions as a lightweight backdoor with remote code execution capabilities. It has self-propagating capabilities.

According to ArsTechnica.com, the malware takes five screenshots over a 10-second period. According to SecurityAffairs.com, the malware uses Windows Script Host and ActiveX-driven logic to launch a bundled Tor proxy and poll a hidden-service C2 server.