[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmM3i0TE2iyo-7lqpmOiPZhyjlqzhDu6aCM-zvzmKM0Q":3},{"article":4,"iocs":54,"watch_terms":95,"solutions":96,"lesson":177},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"3ac6fdae-4cee-4a00-9d89-452e2db66778","Crypto Clipper uses Tor and worm-like propagation for persistence and control","crypto-clipper-uses-tor-and-worm-like-propagation-for-persistence-and-control-603762","Microsoft Threat Intelligence analyzed a cryptocurrency clipper campaign that combines clipboard theft, wallet replacement, Tor-based communications, and worm-like propagation. Beyond stealing cryptocurrency transactions, the malware establishes persistent access and enables follow-on activity through a lightweight backdoor capability. The post Crypto Clipper uses Tor and worm-like propagation for persistence and control appeared first on Microsoft Security Blog.","A new Windows-based cryptocurrency clipper malware, active since February 2026, combines clipboard theft with Tor-based C2 communications and worm-like propagation. It steals cryptocurrency transactions, establishes persistent access, and can execute follow-on commands through a backdoor. Initial access is gained via malicious .lnk files distributed on USB drives.","Crypto clipper malware uses Tor and worm-like propagation for persistence and control.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F06\u002F17\u002Fcrypto-clipper-uses-tor-worm-like-propagation-for-persistence-control\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FMS_Actional-Insights_Malware-ransomware-2.jpg","2026-06-17T23:11:43+00:00","2026-06-18T02:00:07.481566+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"Microsoft Defender for Endpoint","product",{"name":21,"type":19},"Microsoft Defender Antivirus",{"name":23,"type":24},"Tor","technology",{"name":26,"type":24},"Windows Script Host",{"name":28,"type":24},"ActiveXObject",{"name":30,"type":24},"SOCKS5 proxy","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,62,65,68,71,74,77,80,83,86,89,92],{"type":35,"value":56,"context":57},"Trojan: Win32\u002FCryptoBandits.A","Microsoft Defender Antivirus detection name for the crypto clipper.",{"type":59,"value":60,"context":61},"mitre_attack","T1059.005","Use of VBScript\u002FWSH for execution",{"type":59,"value":63,"context":64},"T1059.007","Use of PowerShell for execution",{"type":59,"value":66,"context":67},"T1113","Screen capture",{"type":59,"value":69,"context":70},"T1071.001","Web Protocols (HTTP\u002FHTTPS) for C2",{"type":59,"value":72,"context":73},"T1041","Exfiltration Over C2 Channel",{"type":59,"value":75,"context":76},"T1547.001","Registry Run Keys \u002F Startup Folder for persistence",{"type":59,"value":78,"context":79},"T1037","Scheduled Task\u002FJob",{"type":59,"value":81,"context":82},"T1055.012","Process Injection (implied by backdoor capability)",{"type":59,"value":84,"context":85},"T1003","OS Credential Dumping (implied by private key theft)",{"type":59,"value":87,"context":88},"T1185","Browser Session Hijacking (implied by clipboard theft)",{"type":59,"value":90,"context":91},"T1048","Exfiltration Over Alternative Protocol (Tor)",{"type":59,"value":93,"context":94},"T1074.001","Data from Local System (clipboard)",[18,21],{"controls":97,"vendors":173},[98,119,144],{"slug":99,"name":100,"problem":101,"products":102},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[103,111],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[124,128,136],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":125,"product_name":18,"url":126,"description":127},"defender-for-endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":145,"name":146,"problem":147,"products":148},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[149,157,165],{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":158,"vendor_name":159,"vendor_logo":160,"product_slug":161,"product_name":162,"url":163,"description":164},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":166,"vendor_name":167,"vendor_logo":168,"product_slug":169,"product_name":170,"url":171,"description":172},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[174],{"slug":104,"name":105,"logo_path":106,"roles":175},[176],"reported_by",{"slug":178,"title":179,"body":180,"framework_refs":181,"framework_notes":192},"crypto-clipper-malware-spreads-via-usb-with-tor-based-c2-and-worm-propagation","Crypto Clipper Malware Spreads via USB with Tor-Based C2 and Worm Propagation","This malware campaign highlights the continued danger of physical media attacks, exploiting user trust in USB drives to deliver malicious .lnk shortcut files that silently install a cryptocurrency clipboard hijacker. Once active, the malware establishes resilient command-and-control over Tor, making it difficult to block or trace, while worm-like propagation ensures it spreads laterally across connected systems. The combination of clipboard theft, backdoor access, and self-replication dramatically amplifies the potential damage from a single infected device. This matters because cryptocurrency transactions are irreversible — once funds are redirected by clipboard manipulation, victims have no recourse for recovery. Organizations and individuals lacking endpoint controls and USB policies are particularly exposed.",[182,183,184,185,186,187,188,189,190,191],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 6: Access Control Management","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SC-18: Mobile Code","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-19: Access Control for Mobile Devices","NIST SP 800-53 SC-7: Boundary Protection","NIST CSF DE.CM-1: Network Monitoring","ITIL Service Transition: Change and Configuration Management",{}]