A lightweight script that watches the Windows clipboard, yet it installs a persistent backdoor able to accept remote commands and siphon cryptocurrency credentials. Microsoft said the campaign, which it has named Crypto Clipper, has targeted Windows users since February 2026 and was described in a technical analysis published on 17 June 2026. The malware arrives on removable USB drives as malicious .lnk shortcut files, uses a bundled Tor client and a local SOCKS5 proxy to hide traffic, and can replace copied wallet addresses or exfiltrate 12 and 24 word seed phrases. Microsoft advised defenders to hunt for specific behavioural signals and said Defender products include detections for the family and its components.

The campaign looks like a classic clipper, but it behaves like a worm and a remote access tool. But microsoft Threat Intelligence and Microsoft Defender Experts said Crypto Clipper spreads when a user opens an infected USB drive and triggers a malicious .lnk shortcut. That shortcut runs Windows Script Host code which checks whether the system is already infected and, if not, downloads a script-based payload through a Tor proxy. The actors rename a Tor binary to ugate.exe, launch it in a hidden window and wait roughly 60 seconds for Tor to bootstrap before registering the victim with a hidden-service command-and-control server.

How the malware operates

On the surface the payload is modest. It relies on WScript and ActiveXObject rather than a conventional installer, and Microsoft described it as script-driven. But the scripts implement several capabilities that raise the stakes for victims. First, the clipper monitors the clipboard at high frequency, roughly every 500 milliseconds, parsing copied content for patterns that match private keys, wallet addresses and 12 or 24 word seed phrases. When the malware finds a match it uploads the credentials and, in parallel, captures five screenshots over a 10 second window to provide context for the stolen data. Second, the clipper will silently replace copied wallet addresses with attacker-controlled addresses so transfers are diverted without the user noticing.

Persistence and lateral spread are handled in worm-like fashion. The malware scans the USB drive for common document types, hides the originals and creates lookalike shortcut files that preserve the original file names but point to the malicious loader. It also creates scheduled tasks to survive reboots and attempts to exclude its files from Microsoft Defender scanning. If the command-and-control returns an EVAL instruction the script will execute attacker supplied code at runtime, giving operators a live remote-execution foothold on infected machines.

Opsec and detection challenges

The campaign avoids exposed, IP based infrastructure by routing all command-and-control traffic through Tor and a local SOCKS5 proxy bound to localhost:9050, which complicates network level detection and attribution. Microsoft flagged anti-analysis behaviour in the scripts, including an early exit if Task Manager is detected. Those measures reduce the artefacts defenders normally rely on when hunting conventional malware.

Mastheads

Microsoft’s write-up set out practical detection signals for defenders. The company said defenders should watch for script interpreters spawning suspicious child processes, unexpected localhost:9050 proxy usage, PowerShell commands that capture the screen, and evidence of clipboard inspection or address replacement.

Microsoft Defender for Endpoint identifies multiple components as Suspicious JavaScript process and Possible data exfiltration using Curl, while Microsoft Defender Antivirus detects the family as Trojan: Win32/CryptoBandits.A.

The analysis emphasised an operational trade-off that makes the campaign notable: a modest, script based stealer paired with anonymised communications and runtime tasking produces oversized attacker control and monetisation options. In short, the actors get a low footprint on disk but can still issue remote instructions, harvest high value credentials and divert funds.

Microsoft’s technical analysis describes the full attack chain from USB insertion to clipboard theft and C2 driven tasking, and includes behaviour based indicators and detection names for defenders. The company said Defender products include detections for the malware family and its components, and it published the analysis and guidance on 17 June 2026.

For organisations and individual users the route of infection is familiar and stark. Removable media used without caution remains a common vector because Windows will honour shortcuts and script hosts by default on many systems. The reliance on WScript and ActiveXObject means the activity often appears as legitimate interpreter execution until a deeper behavioural look is taken. Microsoft recommended that defenders rely on the behavioural signals named in its report and on the provided Defender detections to identify and remediate infections.

Related Articles

Microsoft published the technical analysis and detection guidance on 17 June 2026. Originally reported by Ars Technica.

This article was created with AI assistance.