Microsoft Threat Intelligence has issued a warning about a Windows-based crypto clipper campaign that has been affecting users since February 2026. According to Microsoft's threat report, the malware is detected as Trojan/CryptoBandits.A by Microsoft Defender Antivirus and related variants. The campaign combines clipboard theft, wallet address replacement, screenshot capture, and remote code execution capabilities to create a sophisticated threat that goes beyond basic wallet switching. Unlike typical crypto clippers that simply replace copied wallet addresses, this campaign transforms infected machines into footholds for ongoing attacker access, providing both immediate monetization opportunities and ongoing control over compromised devices.
The attack begins with malicious .lnk shortcut files that are distributed via USB storage devices and launch a worm component on infected Windows systems. As reported by Microsoft, the malware spreads through malicious Windows shortcut (.lnk) files distributed via USB storage devices. The malicious files hide legitimate documents and replace them with shortcut files carrying the same names, with users opening what appears to be normal documents triggering the malware execution in the background. The worm also establishes scheduled tasks for persistence, allowing the malware to maintain access even after system restarts. Microsoft noted that the threat uses script-based tools rather than large installers, making simple file-based detection more challenging. The infection chain begins when a victim executes a malicious .lnk file, with the malware then installing both a worm component and additional payloads.
Microsoft's security researchers found that Crypto Clipper continuously monitors a victim's clipboard for high-value cryptocurrency data, including 12-word and 24-word seed phrases, Ethereum private keys, and Bitcoin wallet credentials. The malware checks the clipboard approximately every 500 milliseconds to search for these critical data points. Once detected, the information is exfiltrated through Tor-based command-and-control infrastructure. The malware can replace copied cryptocurrency addresses with attacker-controlled alternatives that target several blockchain networks, including Bitcoin, Tron, and Monero. The address substitution feature is designed to replace copied wallet addresses with lookalike addresses that reduce the chances of detection during transfers, enabling attackers to intercept and control cryptocurrency transactions.
The malware deploys a portable Tor client and routes communications through hidden services using localhost:9050 and .onion command-and-control domains. According to Microsoft's analysis, this configuration reduces normal DNS visibility and makes blocking more difficult. The malware can receive instructions from attackers, including commands that allow arbitrary code execution on compromised systems. The malware also captures screenshots of the victim's device, providing attackers with additional context on wallets and balances. This combination of Tor-based communications, clipboard theft, screenshot collection, and remote tasking gives attackers both immediate monetization opportunities and ongoing control over infected devices, enabling them to maintain persistent access and monitor victim activity.
Organizations can reduce exposure by monitoring for unusual clipboard access and wallet replacement behavior, detecting unauthorized Tor client installations and SOCKS5 proxy usage, restricting execution of untrusted .lnk files, and deploying Endpoint Detection and Response (EDR) solutions. Microsoft recommends disabling AutoRun for removable media, blocking .lnk file execution on USB drives via group policy, and restricting script hosts such as wscript.exe and cscript.exe. Microsoft Defender customers can run hunting queries to check for related activity, including connections to a local Tor proxy on port 9050. The company has published a list of indicators of compromise, including file hashes and .onion domains used as command-and-control servers, for security teams to check their networks against. Microsoft emphasizes that defenders should avoid investigating isolated indicators in this campaign, as clipboard manipulation, Tor activity, suspicious .lnk files, and remote command execution may appear unrelated when viewed separately.
