Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2
Summary: Microsoft's Defender Security Research Team disclosed a Windows cryptocurrency clipper campaign called CryptoBandits that has targeted users since February 2026, using a malicious USB LNK file that spreads a worm component and fetches a clipper payload from a remote server. The clipper runs a bundled Tor client through a local SOCKS5 proxy to poll a hidden-service C2 server, checks the clipboard roughly every 500 milliseconds for seed phrases and private keys, substitutes copied wallet addresses, uploads screenshots, and executes attacker-supplied code when the C2 returns an EVAL response.
What you should know: The malware exits when Task Manager is running and needs no installer or exposed IP-based C2, so signature-based defenses and IP blocklists have little to match on. A USB drive that plants document-named LNK files can turn one employee's click into wallet-address substitution and a lightweight backdoor on machines that handle financial workflows.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026