Microsoft Spots Self-Propagating Malware That Steals Crypto Over Tor

Microsoft has identified a new lightweight backdoor malware that spreads via USB drives and communicates with its operators over the Tor anonymity network. malware, being described as a 'Crypto Clipper', works by monitoring clipboard contents and swapping out cryptocurrency wallet addresses when users copy them, silently redirecting payments to attacker-controlled wallets instead.

This is a classic but effective attack. Most people copy-paste crypto addresses rather than typing them manually, so a clipboard hijacker sitting quietly in the background can intercept real transactions without the victim noticing until it's far too late. The Tor-based communication makes tracking the command-and-control infrastructure significantly harder for researchers and law enforcement.

USB propagation is a particularly interesting distribution choice in 2026. It suggests the attackers are targeting environments where internet-based infection vectors are restricted, possibly corporate or industrial networks with tighter controls. Air-gapped or semi-isolated systems that still exchange USB drives are a known weak point.

If you're handling cryptocurrency in any professional capacity, the practical takeaway is simple: always verify the full wallet address after pasting, not just the first and last few characters. And perhaps review your organisation's USB device policies while you're at it.

A ransomware attack on NHS systems across England disrupted patient record access, appointment scheduling, and internal