Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2
Microsoft details a Windows clipper malware campaign using USB LNK worm and Tor C2.
Microsoft has detailed a Windows-based cryptocurrency clipper campaign active since February 2026. The malware uses a USB LNK worm to spread, hides documents, and then deploys a clipper that steals cryptocurrency wallet information. It leverages a bundled Tor proxy for C2 communication, enabling high-frequency clipboard theft, screenshot exfiltration, and wallet-address substitution.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThis campaign exploits user interaction with USB devices to spread a LNK-based worm that silently deploys a cryptocurrency clipper, demonstrating how physical media remains a potent initial access vector. The malware substitutes clipboard wallet addresses and exfiltrates screenshots, meaning victims lose funds without obvious indicators of compromise. By routing C2 traffic through a bundled Tor proxy, the attackers effectively evade network-level detection and domain blocklists. This matters because cryptocurrency transactions are irreversible, making prevention and early detection the only meaningful defenses — post-theft recovery is rarely possible.
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Windows Clipper
- malware — USB LNK Worm