Home cryptocurrency Hackers Use Tor-Routed C2 and Local SOCKS5 Proxy to Control Crypto Clipper...

Hackers Use Tor-Routed C2 and Local SOCKS5 Proxy to Control Crypto Clipper Malware

0
Tor Proxy Malware Control

A sophisticated cryptocurrency clipper malware campaign has been compromising Windows systems since February 2026.

Unlike traditional stealers that rely on standard IP-based command-and-control (C2) servers, this malware uses a portable Tor client and a local SOCKS5 proxy.

This turns a financially motivated data stealer into a lightweight, remote backdoor capable of bypassing conventional network defenses.

The malware is distributed through malicious shortcut (.lnk) files on USB storage devices.

Once a victim clicks the shortcut, the malware deploys two distinct components: a worm for propagation and a stealer for harvesting cryptocurrency wallet information.

This dual approach ensures the malware can spread to other uninfected USB drives while silently siphoning high-value financial data in the background.

Tor Proxy Malware Control

Initial access occurs when users open seemingly legitimate document files on an infected USB drive. The malicious script checks if the system is already infected.

If not, it pulls down encrypted payloads via Tor. The malware drops heavily obfuscated JavaScript files into public document folders and creates scheduled tasks to ensure persistence across reboots.

High level execution flow (Source: microsoft)

The stealer component relies on Windows Script Host and ActiveX objects to interact with the operating system. It operates in a continuous loop, checking the clipboard every 500 milliseconds for valuable data. The malware specifically targets:

  • 12 or 24-word BIP39 seed phrases
  • Ethereum and Bitcoin private keys
  • Cryptocurrency wallet addresses for Bitcoin, Tron, and Monero

When a user copies a legitimate cryptocurrency address, the malware seamlessly replaces it with an attacker-controlled address.

To provide threat actors with additional context, the malware also captures multiple screenshots of the victim’s desktop. It uploads them asynchronously to the hidden C2 server.

Initial payload delivery (Source: microsoft)

If instructed by the C2, the malware can execute arbitrary remote code, elevating the threat level far beyond a standard clipper.

Microsoft said, the most notable aspect of this campaign is its stealthy network communication. Instead of contacting a standard web domain, the malware drops a renamed Tor binary called ugate.exe.

This routes all network traffic through a local IP address at localhost:9050. Using the curl command, the malware sends stolen data to .onion domains, obscuring its final destination and frustrating traditional DNS-based blocking methods.

The malware employs multi-layered obfuscation with tools such as PyArmor and PyInstaller. It includes a basic anti-analysis check that halts execution if it detects the Windows Task Manager running.

This simple but effective trick slows down manual triage efforts by security researchers.

Indicators of Compromise

Indicator TypeValueDescription
SHA-256 Hash7630debd35cac6b7d58c4427695579b3e3a8b1cc462f523234cd6c698882a68cCrypto Clipper Worm
SHA-256 Hasha7abf1d9d6686af1cefcd60b17a312e7eb8cfe267def1ec34aeab6128c811630Crypto Clipper Worm
SHA-256 Hash23c1e673f315dafa14b73034a90dd3d393a984451ff6601b8be8142be6487b43Crypto Clipper Worm

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant UpdatesSet Cyberpress as a Preferred Source in Google.

NO COMMENTS

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Exit mobile version