Microsoft Reveals New Cryptocurrency Stealing Trojan Crypto Clipper, Infecting Multiple Windows Devices Since February This Year

On June 19, the Microsoft Security Blog published an article noting that Microsoft’s security research team has uncovered a new cryptocurrency-stealing trojan dubbed Crypto Clipper. Active since February 2026, this malware primarily targets Windows users by spreading malicious .lnk shortcut files through USB removable drives. Crypto Clipper features an embedded Tor client, which it uses to connect to .onion hidden services via a local SOCKS5 proxy for covert command-and-control (C2) communications. Its core functionalities include scanning the clipboard for cryptocurrency addresses, stealing wallet mnemonic phrases and private keys, substituting malicious addresses during transactions, capturing and uploading screenshots, and receiving commands to execute remote code. Microsoft explained that the malware has worm-like propagation capabilities: it automatically hides original files on USB drives, creates malicious shortcuts matching the original file names, sets up scheduled tasks to maintain long-term presence (persistence), and spreads independently. Researchers have identified the threat as Trojan:Win32/CryptoBandits.A, and are recommending users disable AutoPlay for removable media, restrict script interpreter execution permissions, and closely monitor traffic to localhost:9050 (used by the Tor proxy) as well as any unusual clipboard access behavior.