If your organisation holds, processes, or transacts in cryptocurrency — or if your employees do on company devices — there is a newly confirmed threat you need to understand right now. Microsoft has publicly disclosed a sophisticated yet surprisingly lightweight piece of malware designed specifically to drain cryptocurrency wallets, and it is already actively spreading in the wild. Here is everything IT teams need to know to stay protected.

What Is Crypto Clipper? The Threat in Plain English

Microsoft has uncovered a new strain of malware built to quietly drain cryptocurrency from Windows users. In a report on June 17, Microsoft Threat Intelligence and Microsoft Defender Experts say the threat — a so-called "clipper" — has been infecting devices since February 2026.

The company named the worm Crypto Clipper because it monitors the contents of device clipboards for patterns consistent with wallet addresses or seed phrases.

In practice, this means any time a user copies a crypto wallet address to paste it elsewhere — a routine action during any transaction — the malware is watching.

What makes Crypto Clipper particularly concerning for enterprise IT teams is not just what it steals, but what it can become.

The malware demonstrates a shift toward lightweight, script-based threats that combine financial theft with broader backdoor capabilities.

In other words, this is not a blunt smash-and-grab tool. It is a stealthy, evolving threat.

How Crypto Clipper Spreads: The USB Vector

The initial infection method is deceptively low-tech, which is precisely what makes it so effective.

Microsoft said it observed Crypto Clipper spreading through .lnk files on a USB drive.

These are Windows shortcut files that store and execute code.

Once a user clicks on one of the disguised shortcuts, the worm component activates and drops two malicious JavaScript files into a subfolder under the public documents directory.

It also creates scheduled tasks to ensure it keeps running even after a restart.

This persistence mechanism means a single click on an infected USB drive could leave a device compromised indefinitely, even across reboots and user sessions.

To ensure it spreads further,

the malware scans the infected USB drive and names the .lnk files with similar names

to legitimate files already stored on the drive, cleverly camouflaging itself from a casual inspection.

What It Does Once Inside: Clipboard Hijacking, Screenshots, and Remote Control

Once embedded in a system, the malware wastes no time.

After registration with the command-and-control server, the malware enters a continuous loop, polling for instructions and monitoring the clipboard roughly every 500 milliseconds, extracting seed phrases and private keys that match wallet-related patterns.

The theft goes further than simply reading copied text.

When users copy wallet addresses, the malware can replace them with attacker-controlled addresses, redirecting transactions without the victim immediately noticing.

A payment that appears to go to the right recipient is silently rerouted — and in crypto, transactions are irreversible.

The threat also searches for Bitcoin and Ethereum-related private keys and BIP39 seed phrases, which are commonly used to recover cryptocurrency wallets.

Beyond clipboard manipulation,

when a match is found, the malware also takes five screenshots over a 10-second period. Both the credentials and the screenshots are then sent

to the attacker.

Captured information is transmitted to attackers through Tor-based channels, while screenshots are collected to provide additional context about wallet activity and account balances.

Critically,

Microsoft highlighted that the malware includes remote command execution capabilities, allowing attackers to send instructions and execute additional code on infected systems — expanding the threat beyond a simple crypto clipper into a flexible tool capable of supporting further malicious activity.

Why It Is So Hard to Detect

Traditional security tools are often built around known signatures and obvious network traffic. Crypto Clipper was engineered to evade both.

Crypto Clipper establishes the Tor connection by using a SOCKS5 proxy, a network protocol that sends traffic through a proxy server, which then forwards it to its final destination.

This means outbound traffic does not point to a traceable attacker IP address — it simply disappears into the Tor network.

Microsoft itself explained the challenge: "The execution of this clipper is notable because it does not depend on a traditional installer or exposed IP-based C2 infrastructure."

The use of a bundled Tor client, scheduled tasks for persistence, and worm-like USB propagation makes the campaign particularly difficult to detect and disrupt.

Security researchers noted that the campaign relies heavily on behavioural indicators rather than traditional file-based detection. Suspicious activity includes script engines launching unexpected processes, cryptocurrency address manipulation, PowerShell-based screen capture, and unusual Tor proxy connections through localhost port 9050.

How Microsoft Security Tools Flag the Threat

The good news is that Microsoft's own security stack has been updated to detect Crypto Clipper — provided organisations are running up-to-date tooling.

Microsoft Defender Antivirus detects related components of the malware family under the designation Trojan:Win32/CryptoBandits.A, while Microsoft Defender for Endpoint provides additional behavioural detections for suspicious scripting activity, data exfiltration attempts, and abnormal process execution.

More generically, the strongest indicators of infection are script interpreters spawning suspicious child processes, proxy usage on localhost:9050, screen-capture commands in PowerShell, and signs of clipboard inspection or crypto-address replacement.

IT teams using Microsoft Defender for Endpoint should ensure their threat detection rules are current and that alerts for suspicious JavaScript processes and unusual curl-based data exfiltration are being actively monitored.

Practical Tips: What IT Teams Should Do Right Now

The following actions should be prioritised immediately across any organisation that manages Windows endpoints:

Proxy usage on localhost:9050 is a strong indicator of infection

— flag and investigate this traffic in your SIEM or network monitoring tools immediately.
- Ensure Microsoft Defender is fully updated.

Microsoft Defender Antivirus detects the threat as Trojan:Win32/CryptoBandits.A

— verify your definitions are current across all managed devices.
- Audit scheduled tasks on endpoints. Because

the malware creates scheduled tasks to ensure it keeps running even after a restart

, a review of unfamiliar or recently created scheduled tasks can reveal active infections.
- Educate employees about crypto address verification.

Microsoft advises users to verify wallet addresses before sending transactions, avoid opening unknown shortcut files, and remain cautious when using removable media devices.

The Bigger Picture: A New Wave of Crypto-Targeting Threats

Crypto Clipper does not exist in isolation. It is part of a broader and accelerating trend of financially motivated malware targeting digital assets on enterprise and personal Windows devices.

Since February 2026, Microsoft Defender Experts have tracked this cryptocurrency clipper campaign that combines clipboard theft, wallet address replacement, worm-like functionality, and Tor-based communications, enabling both financial gain and continued access to devices.

This is the evolution of financially motivated cybercrime: attackers are no longer satisfied with a one-time data grab. By blending theft with a persistent backdoor, they ensure that even after the initial crypto is stolen, the compromised device remains a valuable asset for further attacks, credential harvesting, or lateral movement across a corporate network.

Conclusion: Do Not Wait to Act

The discovery of Crypto Clipper is a timely reminder that cryptocurrency-related threats have moved firmly into the enterprise threat landscape. This is no longer solely a concern for individual crypto enthusiasts — it is an active risk for any organisation whose employees handle digital assets, even occasionally. The combination of a simple USB attack vector, invisible Tor-based exfiltration, and persistent backdoor capabilities makes this a serious, multi-layered threat that demands an immediate response.

Is your organisation's endpoint security posture ready to detect and block this kind of threat? Now is the time to review your Microsoft Defender configurations, tighten USB policies, and run a sweep for the indicators of compromise outlined above. If you would like a professional security audit of your Windows endpoint environment or help configuring Microsoft Defender for Endpoint to detect emerging threats like Crypto Clipper, get in touch with our team today — before a clipboard becomes a gateway to your organisation's digital assets.