Crypto Clipper Worm Targets Wallets

Microsoft has identified a novel self-propagating malware named Crypto Clipper, which utilizes USB drives to target cryptocurrency credentials. This worm is designed to continuously monitor the contents of a device's clipboard for patterns matching cryptocurrency wallet addresses or seed phrases.

Upon detecting relevant information, Crypto Clipper captures five screenshots over a ten-second interval. This data, along with the clipboard contents, is then transmitted to attacker-controlled servers using the anonymous routing capabilities of the Tor network. The malware establishes this connection through a SOCKS5 proxy, effectively turning a financial stealer into a remote backdoor.

Microsoft observed Crypto Clipper spreading via .lnk files on infected USB drives. When an infected drive is connected, the malware checks for its presence and, if not found, downloads itself through the Tor proxy. To evade detection, it renames .lnk files on the USB drive to mimic legitimate ones. The malware also replaces identified cryptocurrency addresses with those belonging to the attackers, enabling direct diversion of payments.

This threat family highlights the significant impact of lightweight, script-based stealers when combined with anonymized communication and remote execution capabilities. The integration of Tor-routed command and control, clipboard monitoring, screenshot capture, and remote code execution provides attackers with immediate monetization opportunities and ongoing control over compromised systems. Microsoft Defender for Endpoint detects related components as Suspicious JavaScript processes and Possible data exfiltrations using Curl, while Microsoft Defender Antivirus identifies it as Trojan:Win32/CryptoBandits.A.