Security
Microsoft warns of Crypto Clipper, a self-spreading worm targeting cryptocurrency wallets
A new malware spreads via USB drives and uses Tor to anonymously exfiltrate cryptocurrency credentials and screenshots to attackers.
Ars Technica
Microsoft has discovered a self-propagating worm called Crypto Clipper that hunts for cryptocurrency wallet credentials and seed phrases on infected devices.
The malware operates by monitoring clipboard contents for patterns matching cryptocurrency addresses and then capturing five screenshots over a 10-second window. Both the stolen credentials and screenshots are funneled through the Tor anonymity network to attacker-controlled servers using a SOCKS5 proxy to obscure the data's origin.
How it spreads and hides#
Crypto Clipper propagates through .lnk files stored on USB drives. When an infected drive connects to a target machine, the malware checks if it's already installed. If not, it downloads itself via the Tor proxy. To avoid detection, it renames the .lnk files on the USB to blend in with legitimate shortcuts.
According to Microsoft, what makes this threat noteworthy is its "lightweight backdoor" architecture: it avoids traditional installation methods and IP-based command-and-control infrastructure entirely. Instead, it bundles a portable Tor client to maintain anonymity while blending data-stealing functionality with remote code execution capabilities.
