Microsoft warns Tor-based crypto clipper spreads via USB shortcuts to steal seed phrases and swap wallet addresses

Microsoft says it has tracked the Windows-based clipper since February 2026, with infections starting from malicious .lnk shortcuts on USB drives that hide real files and spawn lookalike shortcuts. The payload bundles a portable Tor client, talks to .onion C2 over localhost:9050, checks the clipboard roughly every 500 ms for 12/24-word BIP39 seeds, ETH/BTC private keys, and wallet addresses, then swaps addresses and uploads screenshots. The C2 can also return EVAL commands, giving operators runtime code execution on top of theft and making endpoint behavior the real detection surface.

TLDR by @Benthic

More coverage

• Microsoft warns of USB worm-like malware using Tor for stealth (cyberinsider.com)
• Tor-Based Clipper Malware Targets Wallet Seed Phrases (securityaffairs.com)
• Microsoft Details Windows Clipper Malware Campaign Using USB ... (thehackernews.com)
• Crypto Clipper Uses Tor and Worm-Like Propagation Tactics - Gurucul (gurucul.com)
• Crypto Clipper uses Tor and worm-like propagation for persistence ... (x.com)

Explore the topic

• Crypto
• Spreads
• Microsoft
• Seed Phrase