ChainCatcher reported that Microsoft Security Blog published findings from Microsoft’s security research team on a new cryptocurrency-stealing Trojan named Crypto Clipper. According to the post, the malware has been active since February 2026 and targets Windows users. Its primary infection method is the use of malicious .lnk shortcut files distributed through USB devices. Microsoft detects the threat as Trojan:Win32/CryptoBandits.A.
USB-based spread and malicious shortcut files
Microsoft said Crypto Clipper has worm-like propagation capabilities. During infection, the malware automatically hides original documents stored on a USB drive and creates malicious shortcuts with the same names as those original documents. As a result, users may interact with what appears to be a normal file entry while actually launching the malicious shortcut. The infection flow described by Microsoft centers on removable devices and Windows shortcut files.
The malware also creates scheduled tasks to maintain persistence on an infected system. This persistence mechanism allows Crypto Clipper to continue operating after the initial infection, supporting ongoing data theft, command reception, and clipboard monitoring. The details published by Microsoft describe a threat that combines propagation, persistence, and remote control functions rather than a simple clipboard replacement tool.
Tor-based C2 communication and crypto theft functions
Crypto Clipper includes a built-in Tor client. It connects to .onion hidden services through a local SOCKS5 proxy, enabling covert command-and-control communication. Microsoft advised users to monitor Tor proxy traffic on localhost:9050, as well as abnormal clipboard access behavior. This communication setup allows the malware to maintain contact with its control infrastructure and receive remote code execution commands.
Its main functions include high-frequency clipboard monitoring, theft of seed phrases and private keys, replacement of cryptocurrency transfer addresses, screenshot capture and upload, and execution of remote instructions. Microsoft recommended disabling autorun for removable devices, restricting the execution permissions of script interpreters, and monitoring localhost:9050 Tor proxy traffic together with unusual clipboard access activity.