Microsoft reveals a new type of cryptocurrency-stealing Trojan called Crypto Clipper, which has infected multiple Windows devices since February of this year

The Microsoft Security Blog reported that the Microsoft security research team discovered a new type of cryptocurrency stealing Trojan named Crypto Clipper. This malware has been active since February 2026, primarily spreading through USB devices that infect Windows users with malicious .lnk shortcuts. Crypto Clipper has a built-in Tor client that connects to .onion hidden services via a local SOCKS5 proxy, enabling covert C2 communication. Its main functions include high-frequency monitoring of the clipboard, stealing mnemonic phrases and private keys, replacing cryptocurrency transfer addresses, capturing screenshots and uploading them, as well as receiving remote code execution commands.

Microsoft stated that this malware has worm propagation capabilities, automatically hiding original documents on USB drives and generating malicious shortcuts with the same name, while also creating scheduled tasks for persistent control. Researchers detected it as Trojan:Win32/CryptoBandits.A and recommended that users disable autorun for removable devices, restrict script interpreter execution permissions, and closely monitor localhost:9050 Tor proxy traffic and abnormal clipboard access behaviors.