Cybercriminals are bridging the gap between old-school offline IT vulnerabilities and modern decentralized finance networks. Microsoft Threat Intelligence and Microsoft Defender Experts have identified a highly sophisticated, Windows-based cryptocurrency clipper malware that has been actively spreading since February 2026. The threat operates as a worm, moving physically between computers via infected USB storage devices.
The malware disguises itself inside malicious Windows shortcut files (.lnk) that are engineered to look like completely standard Word, PDF, or Excel documents. Once a user clicks the shortcut, the clipper runs silently in the background, monitoring the operating system’s clipboard every 500 milliseconds. When a user copies a cryptocurrency wallet address, the malware instantly replaces it with an attacker-controlled address.
What We Know
- Targeted Assets: The clipper actively monitors for and hijacks addresses belonging to Bitcoin, Ethereum, Monero, and Tron networks.
- Deep Extraction: Beyond simple copy-paste swapping, the malware extracts highly sensitive core data including cryptocurrency seed phrases and private keys like the Bitcoin Wallet Import Format (WIF).
- Hidden Communications: The payload installs a bundled Tor proxy application called ugate.exe in a hidden window, routing all exfiltrated data through anonymous .onion services.
- Evasion Tactics: The worm features an automated kill switch. If it detects the Windows Task Manager opening, it instantly terminates its own processes to avoid detection by the user.
The engineering behind this campaign is genuinely fascinating because it turns a localized physical infection into a persistent network backdoor. While the primary function is stealing funds by altering the clipboard, the software actually functions as a lightweight remote code execution framework. This allows the remote operators to continuously drop secondary payloads onto the compromised machine long after the initial USB drive is removed.
The creators heavily obscured the code to avoid automated antivirus detection. The payload is packaged using PyInstaller, protected with PyArmor, and utilizes multi-layered runtime decryption to hide its true intentions from standard memory scans. You can read the specific details regarding the hidden C2 operations in the technical breakdown of the crypto clipper published directly by Microsoft Threat Intelligence.
The malware goes as far as taking routine screenshots of the victim’s active desktop and funneling those image files back through the Tor network. By isolating its communication strictly to the Tor proxy, it entirely bypasses standard corporate firewalls that only monitor regular HTTP or DNS traffic.
Why the USB Attack Vector Changes Security Protocols
This threat forces a serious reevaluation of physical endpoint security. We are seeing a direct callback to the early 2000s era of USB worms like Stuxnet or Conficker, but supercharged with modern anonymization and automated financial theft. Decades ago, a USB worm might delete files or hijack a botnet; today, it is explicitly designed to drain decentralized crypto wallets in a matter of seconds.
Microsoft is not treating this as a passive threat. The company has issued direct administrative guidance requiring organizations to fundamentally lock down physical hardware policies. Microsoft advises IT departments to completely disable AutoRun and AutoPlay features for all removable media and enforce strict group policies that restrict the execution of .lnk files directly from USB drives. Administrators are also being told to aggressively monitor any unusual SOCKS5 proxy parameters originating from curl.exe, as that is the primary indicator the Tor backdoor is active.