Clipper malware steals crypto via USB and uses Tor as C2

Fri, 19 Jun 2026 10:00:00 -0300

You copy the Bitcoin wallet address, paste it into the destination field and confirm the transaction. After a few months of working with crypto, the sequence is automatic. The problem is that the address that arrived at the other end wasn't the one you copied — a piece of malware silently swapped the clipboard contents while you weren't looking, and the money ended up in someone else's wallet. That's a clipper. And on 17 June 2026 Microsoft revealed that a campaign using this technique has been active since February, combined with USB propagation and a command-and-control channel hidden inside the Tor network.

Clipper on Locodigital

Clipper malware steals crypto via USB and uses Tor as C2