A sophisticated cryptocurrency clipper malware campaign has been compromising Windows systems since February 2026.
Unlike traditional stealers that rely on standard IP-based command-and-control (C2) servers, this malware uses a portable Tor client and a local SOCKS5 proxy.
This turns a financially motivated data stealer into a lightweight, remote backdoor capable of bypassing conventional network defenses.
The malware is distributed through malicious shortcut (.lnk) files on USB storage devices.
Once a victim clicks the shortcut, the malware deploys two distinct components: a worm for propagation and a stealer for harvesting cryptocurrency wallet information.
This dual approach ensures the malware can spread to other uninfected USB drives while silently siphoning high-value financial data in the background.
Tor Proxy Malware Control
Initial access occurs when users open seemingly legitimate document files on an infected USB drive. The malicious script checks if the system is already infected.
If not, it pulls down encrypted payloads via Tor. The malware drops heavily obfuscated JavaScript files into public document folders and creates scheduled tasks to ensure persistence across reboots.
The stealer component relies on Windows Script Host and ActiveX objects to interact with the operating system. It operates in a continuous loop, checking the clipboard every 500 milliseconds for valuable data. The malware specifically targets:
- 12 or 24-word BIP39 seed phrases
- Ethereum and Bitcoin private keys
- Cryptocurrency wallet addresses for Bitcoin, Tron, and Monero
When a user copies a legitimate cryptocurrency address, the malware seamlessly replaces it with an attacker-controlled address.
To provide threat actors with additional context, the malware also captures multiple screenshots of the victim’s desktop. It uploads them asynchronously to the hidden C2 server.
If instructed by the C2, the malware can execute arbitrary remote code, elevating the threat level far beyond a standard clipper.
Microsoft said, the most notable aspect of this campaign is its stealthy network communication. Instead of contacting a standard web domain, the malware drops a renamed Tor binary called ugate.exe.
This routes all network traffic through a local IP address at localhost:9050. Using the curl command, the malware sends stolen data to .onion domains, obscuring its final destination and frustrating traditional DNS-based blocking methods.
The malware employs multi-layered obfuscation with tools such as PyArmor and PyInstaller. It includes a basic anti-analysis check that halts execution if it detects the Windows Task Manager running.
This simple but effective trick slows down manual triage efforts by security researchers.
Indicators of Compromise
| Indicator Type | Value | Description |
|---|---|---|
| SHA-256 Hash | 7630debd35cac6b7d58c4427695579b3e3a8b1cc462f523234cd6c698882a68c | Crypto Clipper Worm |
| SHA-256 Hash | a7abf1d9d6686af1cefcd60b17a312e7eb8cfe267def1ec34aeab6128c811630 | Crypto Clipper Worm |
| SHA-256 Hash | 23c1e673f315dafa14b73034a90dd3d393a984451ff6601b8be8142be6487b43 | Crypto Clipper Worm |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
