New Clipper Malware Spreads via Weaponized Windows Shortcuts on USB Drives

Key Takeaways

• A sophisticated cryptocurrency clipper malware has been active since February 2026, targeting digital assets.
• The primary infection vector is weaponized Windows shortcut (.lnk) files distributed via USB drives, employing worm-like propagation.
• The malware utilizes the Tor network for command-and-control (C2) communications, making detection and blocking challenging.
• It performs high-frequency clipboard theft, replacing legitimate cryptocurrency wallet addresses with attacker-controlled ones, and exfiltrates screenshots.
• Defenders are advised to disable AutoRun/AutoPlay, restrict .lnk execution from USBs, and monitor for specific network and system behaviors.

A new and highly evasive cryptocurrency clipper malware has been actively stealing digital assets from unsuspecting victims since February 2026, according to recent findings. This threat distinguishes itself through its stealthy distribution mechanism: weaponized Windows shortcut files (.lnk) disseminated via USB drives, a method designed to bypass typical user vigilance.

The campaign, detailed in a report by Microsoft Threat Intelligence and Microsoft Defender Experts, reveals a sophisticated financially motivated operation. Beyond mere theft, the malware exhibits worm-like propagation capabilities, leverages the Tor network for covert communications, and can execute remote commands, marking it as a significant threat in the current landscape.

The attack sequence initiates when an infected USB drive is connected to a machine. Users are lured into clicking what appears to be a legitimate document, which is, in reality, a malicious shortcut. This action silently triggers the deployment of harmful payloads in the background. The malware then conceals the original files on the USB, replacing them with identical-looking shortcuts, thereby setting a trap for subsequent users or machines.

As Microsoft outlined in their report, the malware engages in rapid-fire clipboard monitoring to swap wallet addresses, exfiltrates screenshots, and routes all its illicit traffic through the Tor network. The operators behind this threat have engineered it for maximum stealth, avoiding traditional installers, obfuscating IP addresses, and encrypting core payloads until execution, all indicative of a well-resourced and determined adversary.

The financial ramifications for victims are immediate and severe. By surreptitiously altering copied cryptocurrency wallet addresses with those belonging to the attackers, the malware can redirect entire transactions, often without the victim realizing until their funds are irrevocably lost.

Hackers Use Weaponized Windows Shortcuts

The malware’s initial compromise strategy relies on a deceptively simple yet effective technique. Upon infecting a machine, the worm component scans any connected USB drive for common file types such as .doc, .xlsx, and .pdf. It then hides these original files and generates malicious shortcut files bearing the same names, effectively camouflaging them to ensnare the next user.

When a victim clicks one of these deceptive shortcuts, the worm proceeds to drop two malicious JavaScript files into a newly created subfolder within “C:UsersPublicDocuments.” Both the folder and file names adhere to a five-character naming convention, further aiding obfuscation. Concurrently, it establishes two scheduled tasks to ensure the persistence of the stealer module and to facilitate the worm’s continued propagation to any new USB devices connected to the compromised system.

The installation process is wrapped in multiple layers of obfuscation. The initial payload is a Python script, fortified with PyArmor and bundled into a standalone executable. The JavaScript files themselves feature a dual-layer obfuscation scheme. Notably, the malware also incorporates a self-termination mechanism, shutting down if it detects the Task Manager running, thereby complicating manual analysis and incident response efforts.

Tor-Routed Command and Control and Clipboard Theft

Central to this malware’s operational security is a portable Tor client, disguised as “ugate.exe,” which runs in a hidden window. Once the Tor client is active, the malware establishes communication with its command-and-control (C2) server exclusively via .onion addresses. This design choice renders traditional IP-based blocking strategies largely ineffective, significantly enhancing the attackers’ anonymity and resilience.

The clipper actively monitors the system clipboard at approximately 500-millisecond intervals. Its primary objective is to detect copied cryptocurrency seed phrases, private keys, and wallet addresses. Upon identifying a legitimate wallet address, the malware silently replaces it with an address controlled by the attacker. It supports a wide array of cryptocurrency formats, including Bitcoin legacy, P2SH, Taproot, Bech32, Tron, and Monero addresses, ensuring broad applicability across different digital assets.

In addition to clipboard manipulation, the malware captures five screenshots at ten-second intervals, transmitting them back to the attacker via the Tor network. This provides the operators with valuable visual intelligence regarding the victim’s activities, particularly those involving financial transactions. Furthermore, the C2 server can issue an EVAL command, enabling the attackers to execute arbitrary code directly on the victim’s machine, offering a potent backdoor for further exploitation.

What You Should Do

• Disable AutoRun/AutoPlay: Configure Windows to disable AutoRun and AutoPlay functionalities for all removable media to prevent automatic execution of malicious files.
• Restrict .lnk Execution: Implement Group Policy rules to block the execution of .lnk files from USB drives and other removable media.
• Limit Script Interpreters: Restrict the use of script interpreters like wscript.exe and cscript.exe in environments where they are not essential for legitimate operations.
• Monitor Network Traffic: Actively hunt for SOCKS5 proxy traffic on localhost:9050, a common indicator of Tor client activity initiated by the malware.
• Review Financial Workflows: Implement stringent review processes for clipboard usage and screen-capture behaviors on devices involved in cryptocurrency transactions or other financial activities.
• Educate Users: Conduct regular cybersecurity awareness training for employees, emphasizing the dangers of suspicious files on USB drives and the importance of verifying wallet addresses before completing transactions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.