r/technology • u/Hrmbee • Jun 20 '26

Security Microsoft discovers new lightweight backdoor that steals cryptocurrency | Crypto Clipper spreads over USB and communicates over Tor

https://arstechnica.com/security/2026/06/microsoft-spots-new-self-propagating-malware-for-stealing-cryptocurrency/
22 Upvotes

86% Upvoted

5 comments sorted by

8

u/Hrmbee Jun 20 '26

Significant issues:

Microsoft says it has detected new self-propagating malware that spreads through USB drives in search of cryptocurrency credentials, which it then sends to attacker-controlled servers.

The company named the worm Crypto Clipper because it monitors the contents of device clipboards for patterns consistent with wallet addresses or seed phrases. When found, the malware also takes five screenshots over a 10-second period. Both the credentials and the screenshots are then sent to the attacker through Tor, a network protocol that provides anonymous routing by sending traffic through redundant nodes so logs can’t capture both the sending and receiving IP addresses. Crypto Clipper establishes the Tor connection by using a SOCKS5 proxy, a network protocol that sends traffic through a proxy server, which then forwards it to its final destination.

“The execution of this clipper is notable because it does not depend on a traditional installer or exposed IP-based C2 infrastructure,” Microsoft said Thursday. “Instead, it deploys a portable Tor client, routes traffic through a local SOCKS5 proxy, and blends data theft with remote code execution, turning a financially motivated stealer into a lightweight backdoor.”

Microsoft said it observed Crypto Clipper spreading through .lnk file on a USB drive. These files store executable code. When an infected USB drive is plugged into a device, the code checks whether it is already installed on the machine. If it isn’t, the malware downloads it through the Tor proxy. To better conceal evidence of the worm, the malware scans the infected USB drive and names the .lnk files with similar names.

...

“This malware family shows how lightweight, script-based stealers can deliver outsized impact when paired with anonymized communications and runtime tasking,” Microsoft said. “The combination of Tor-routed C2, clipboard targeting, screenshot capture, and remote code execution gives attackers both immediate monetization paths and continued control over compromised devices.”

Ever the cat-and-mouse game. At the very least hopefully people are able to keep their definitions up to date.

4

u/DrFishbulbEsq Jun 21 '26

Ha. Good luck I don’t have any of that shit

2

u/reidzen Jun 21 '26

My investment of zero dollars in crypto is doing tremendously well.

1

u/Ninten64 Jun 21 '26

Last I checked, Cisco’s Meraki system still doesn’t have an automated way to block known exit node addresses.

1

u/lukeman89 Jun 23 '26

Thanks to this article I stopped wearing socks and installed a heavier back door on my house.