Clipper malware steals crypto via USB and uses Tor as C2

You copy the Bitcoin wallet address, paste it into the destination field and confirm the transaction. After a few months of working with crypto, the sequence is automatic. The problem is that the address that arrived at the other end wasn't the one you copied — a piece of malware silently swapped the clipboard contents while you weren't looking, and the money ended up in someone else's wallet. That's a clipper. And on 17 June 2026 Microsoft revealed that a campaign using this technique has been active since February, combined with USB propagation and a command-and-control channel hidden inside the Tor network.

What clipper malware is

Clipper malware is a program that monitors and manipulates the contents of the operating system's clipboard. When it detects a pattern that looks like a crypto wallet address — Bitcoin, Ethereum, Monero and others — it substitutes the attacker's address before the user notices.

The attack works because wallet addresses are long strings of characters that almost nobody checks in full. Most people copy, paste and click confirm without comparing the whole address. The standard advice is to verify at least the first and last four characters, but in practice few people do that on every transaction.

The CryptoBandits campaign revealed by Microsoft

Microsoft Threat Intelligence published the full analysis on 17 June. According to the report, the campaign has been active since February 2026 and combines four capabilities in a single package: clipboard theft, wallet address substitution, worm-style propagation and C2 communication over Tor. Windows Defender Antivirus classifies the main component as Trojan:Win32/CryptoBandits.A.

The choice of Tor as the C2 channel is no accident. It makes attribution harder and complicates blocking at the corporate firewall level, because the malware embeds a portable Tor client and routes all C2 traffic through a local SOCKS5 proxy on port 9050. To most network monitoring systems, that traffic looks like conventional Tor traffic — which doesn't automatically raise alerts in many organisations.

How it works technically

The malware operates with two distinct components running in parallel:

Worm component: responsible for propagation. It creates malicious .lnk shortcut files on USB drives connected to the infected system. Any other Windows machine that accesses the drive and opens one of those files — especially with AutoPlay enabled — executes the payload. Using a malicious LNK as an infection vector isn't new (Stuxnet used something similar in 2010), but it remains effective against machines with default settings.

Clipper/stealer component: monitors the clipboard roughly every 500 milliseconds. When the contents match the patterns of known crypto wallet addresses, it substitutes the address controlled by the attackers. On top of that, the malware actively hunts for seed phrases and private keys that might be sitting in plain text files or copied to the clipboard — the kind of data that compromises full access to the wallet, not just a single transaction.

Both components also communicate with the C2 over Tor to receive updated wallet addresses and exfiltrate collected data, ensuring the attackers can rotate destination addresses as needed.

Who is at risk

The primary vector is USB, which puts particularly at risk corporate environments with loose policies on removable media. But the worm component guarantees lateral spread: once a system is infected, any USB stick that leaves that workstation can carry the malware to other computers — including machines on other networks.

Home users who trade cryptocurrency and occasionally share files via flash drive are also on the radar. The malware makes no distinction between a low-value wallet and one holding a meaningful balance — it substitutes every address it detects.

How to protect yourself

• Disable AutoPlay in Windows. Go to Settings → Bluetooth & devices → AutoPlay and switch it off for all removable media. That removes the primary vector for LNK files on USB.
• Never plug in an unknown USB stick. A basic rule that still fails in corporate environments when someone finds a flash drive in the car park.
• Check the full address before confirming any crypto transaction. Compare at least 8 characters at the start and 8 at the end. If you use a hardware wallet (Ledger, Trezor), confirm on the device's display — not on the computer screen.
• Use a hardware wallet for meaningful amounts. These wallets sign the transaction offline and show the destination address on their own display, making the clipper useless against anyone who checks on the device before confirming.
• Keep Windows Defender up to date. The Trojan:Win32/CryptoBandits.A detection is already in the latest definitions.
• Monitor processes that access the clipboard frequently. Tools such as Process Monitor (Sysinternals) will identify processes polling the clipboard in a loop — anomalous behaviour in normal use.

If you manage corporate endpoints, auditing Windows security logs via PowerShell can be the first step towards identifying suspicious processes running on workstations. In parallel, protecting exchange accounts with strong authentication is essential — though it's worth remembering that MFA fatigue attacks can compromise even 2FA under enough pressure.

Why this combination is more dangerous than an ordinary clipper

Clipper malware has been around for years, but the combination of a USB worm plus Tor C2 raises the level of sophistication considerably. A simple clipper is detectable by its network behaviour or by the absence of elaborate persistence. Not this one: Tor buries the communication inside apparently legitimate traffic, the worm guarantees propagation even in environments with internet restrictions (via physical USB), and the two separate components complicate incident response — you can remove the clipper without realising the worm is still present on the machine and on drives that have already passed through it.

It's a pattern we also saw in campaigns with a RAT embedded via the supply chain, where multiple layers of persistence ensure that removing the obvious artefact doesn't clean up the infection.

Conclusion

The CryptoBandits campaign is a direct reminder that crypto and information security are intertwined. Anyone dealing in cryptocurrency needs to treat the endpoint with the same rigour they'd apply to bank account access. Disabling AutoPlay, checking wallet addresses character by character and keeping antivirus up to date are simple measures — and still routinely ignored. If you manage a corporate environment with USB policies, it's worth confirming they're actually enforced, not merely documented. And if you use crypto at home with any meaningful volume, a hardware wallet isn't paranoia — it's the minimum reasonable control.

Ever spotted a swapped clipboard address before confirming a transaction, or had to learn the hard way? Tell us in the comments.