Cryptocurrency holders face a threat that is equal parts technically sophisticated and deceptively simple: a clipboard-hijacking malware campaign that weaponizes everyday USB drives, hides its command infrastructure inside the Tor network, and silently redirects funds before victims ever realize something has gone wrong. Researchers tracking this campaign since February 2026 have documented a threat that blends financial theft with persistent backdoor capabilities — a combination that elevates it well beyond the average crypto stealer.

Threat Alert: Cryptocurrency holders face a threat that is equal parts technically sophisticated and deceptively simple: a clipboard-hijacking malware campaign that weaponizes everyday USB drives, hides its command infrastructure inside the Tor network, and silently redirects funds before victims ever realize something has gone wrong.

How the Infection Takes Hold

The attack begins with a file that looks completely harmless. A malicious Windows shortcut — a .lnk file — sits on a USB drive, waiting for someone to open it. Once executed, the malware immediately goes to work on the host system, scanning for common document formats including Word files, spreadsheets, and PDFs. It hides the legitimate originals and replaces them with identically named malicious shortcuts. Open what appears to be a quarterly report and you are, in reality, executing another stage of the infection.

Persistence and propagation are built in from the start. The malware registers scheduled tasks that automatically copy itself onto any removable drive subsequently connected to the compromised machine — a self-replicating mechanism that turns every USB device into a potential delivery vector for the next victim.

Tor as a Shield: Infrastructure Designed to Disappear

What distinguishes this campaign from earlier clipper variants is its deliberate avoidance of traditional command-and-control infrastructure. Rather than communicating with a fixed IP address that defenders could block or researchers could attribute, the malware ships with its own portable Tor client. All traffic is routed through a local SOCKS5 proxy on port 9050 and resolved to .onion hidden service domains, keeping the actual operator completely anonymized and making takedown efforts considerably more difficult.

The combination of Tor-routed communications, clipboard targeting, screenshot capture, and remote code execution gives attackers both immediate monetization paths and continued control over compromised devices.

The malware's execution logic relies on Windows Script Host and ActiveX-driven components rather than a conventional installer, further reducing its footprint and complicating detection through traditional signature-based methods.

The Mechanics of Wallet Theft

The core theft mechanism operates at machine speed, polling the system clipboard every 500 milliseconds. When a cryptocurrency wallet address is detected — covering Bitcoin, Ethereum, Tron, and Monero — it is silently swapped for an attacker-controlled address engineered to visually resemble the original. A casual glance at the pasted address reveals nothing alarming. The funds, however, travel to the attacker's wallet.

Seed phrase theft adds a second layer of financial exposure. The malware actively scans clipboard contents for 12- and 24-word BIP39 mnemonic phrases, the master recovery keys to entire cryptocurrency portfolios. When detected, the phrase is exfiltrated over Tor to the hidden C2 server, with retries until successful transmission is confirmed. Ethereum and Bitcoin WIF private keys receive the same treatment.

To provide operational context, the malware captures five screenshots every ten seconds and routes them to the attacker in near-real time — essentially granting a live window into the victim's financial activity.

From Stealer to Backdoor

Perhaps the most concerning capability is the malware's remote code execution channel. The C2 server can issue an EVAL instruction, causing the malware to download arbitrary JavaScript, write it to a local file, and execute it immediately. This transforms what appears to be a narrowly focused crypto theft tool into a fully functional backdoor, capable of receiving and running any payload the operator chooses to deploy at a later stage.

Obfuscation is layered throughout. All core components are encrypted and only decrypted at runtime. Python code is wrapped using PyArmor and packaged with PyInstaller, while JavaScript payloads receive two additional obfuscation passes. The malware also checks for active Task Manager processes before executing — a simple but effective sandbox and analyst-awareness check.

What You Should Do

Organizations and individuals handling cryptocurrency transactions or sensitive financial workflows should treat this threat with the seriousness it warrants. Key defensive actions include:

What You Should Do
Block .lnk execution from removable media — Enforce this through Group Policy to eliminate the primary infection vector entirely.
Monitor script interpreter activity — Flag and investigate instances of wscript.exe and cscript.exe spawning unusual child processes.
Alert on localhost:9050 proxy usage — Unexpected SOCKS5 traffic on this port is a strong behavioral indicator of embedded Tor client activity.
Watch for screen-capture commands in PowerShell — Automated screenshot activity is a reliable signal of active exfiltration.
Verify wallet addresses through a second channel — Before confirming any high-value transaction, visually verify the destination address character by character, or use a hardware wallet with on-device display confirmation.
Restrict USB drive usage — Implement device control policies that limit which removable media can execute files on corporate or personal financial workstations.
Keep endpoint detection current — Modern endpoint protection platforms with behavioral detection capabilities flag this threat family, but only when definitions and engines are up to date.

The Broader Implication

This campaign is a reminder that technical sophistication does not always require complexity. A shortcut file, a bundled Tor client, and a few hundred lines of obfuscated script are enough to compromise a wallet holding significant value. The threat actors behind this operation have correctly identified that the weakest point in most cryptocurrency security postures is not the blockchain — it is the human moment between copying an address and pasting it. Until that moment is hardened through verification habits and defensive tooling, clipper malware will remain one of the most cost-effective attacks in the cybercriminal playbook.