Microsoft discovers new lightweight backdoor that steals cryptocurrency - Ars Technica

Skip to content

AI

Biz & IT

Cars

Culture

Gaming

Health

Policy

Science

Security

Space

Tech

Forum

Subscribe

Story text

Size

Small<br>Standard<br>Large

Width

Standard<br>Wide

Links

Standard<br>Orange

* Subscribers only

Learn more

Pin to story

Theme

Search

Sign In

Sign in dialog...

Text<br>settings

Story text

Size

Small<br>Standard<br>Large

Width

Standard<br>Wide

Links

Standard<br>Orange

* Subscribers only

Learn more

Minimize to nav

Microsoft says it has detected new self-propagating malware that spreads through USB drives in search of cryptocurrency credentials, which it then sends to attacker-controlled servers.

The company named the worm Crypto Clipper because it monitors the contents of device clipboards for patterns consistent with wallet addresses or seed phrases. When found, the malware also takes five screenshots over a 10-second period. Both the credentials and the screenshots are then sent to the attacker through Tor, a network protocol that provides anonymous routing by sending traffic through redundant nodes so logs can’t capture both the sending and receiving IP addresses. Crypto Clipper establishes the Tor connection by using a SOCKS5 proxy, a network protocol that sends traffic through a proxy server, which then forwards it to its final destination.

A lightweight backdoor

“The execution of this clipper is notable because it does not depend on a traditional installer or exposed IP-based C2 infrastructure,” Microsoft said Thursday. “Instead, it deploys a portable Tor client, routes traffic through a local SOCKS5 proxy, and blends data theft with remote code execution, turning a financially motivated stealer into a lightweight backdoor.”

Microsoft said it observed Crypto Clipper spreading through .lnk file on a USB drive. These files store executable code. When an infected USB drive is plugged into a device, the code checks whether it is already installed on the machine. If it isn’t, the malware downloads it through the Tor proxy. To better conceal evidence of the worm, the malware scans the infected USB drive and names the .lnk files with similar names.

High-level execution flow of Crypto Clipper.

Credit:<br>Microsoft

High-level execution flow of Crypto Clipper.

Credit:

Microsoft

Crypto Clipper monitors clipboard contents for patterns that are consistent with standardized 12- or 24-word seed phrases. When found, it uploads them, along with the screenshots, to the attacker’s server. The stealer also replaces addresses it finds with ones belonging to attacker-controlled wallets. This allows the malware to divert payments to the attacker’s pockets. Microsoft believes the purpose of the screenshots is to provide context that may be useful.

“This malware family shows how lightweight, script-based stealers can deliver outsized impact when paired with anonymized communications and runtime tasking,” Microsoft said. “The combination of Tor-routed C2, clipboard targeting, screenshot capture, and remote code execution gives attackers both immediate monetization paths and continued control over compromised devices.”

Microsoft Defender for Endpoint detects Crypto Clipper components as Suspicious JavaScript processes and Possible data exfiltrations using Curl. Microsoft Defender Antivirus detects it as Trojan: Win32/CryptoBandits.A. More generically, the strongest indications of infection are script interpreters spawning suspicious child processes, proxy usage on localhost:9050, screen-capture commands in PowerShell, and signs of clipboard inspection or crypto-address replacement.

Dan Goodin

Senior Security Editor

Dan Goodin

Senior Security Editor

Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82.

16 Comments

Comments

Forum view

Loading comments...

Prev story

Next story

1.<br>Windows and Linux users: The deadline to update Secure Boot keys is near

2.<br>Tesco moving 40,000 server workloads off VMware amid Broadcom's “abusive conduct”

3.<br>Massive breach spills credentials for thousands of sensitive networks

4.<br>California says AT&T lied to FCC in attempt to shut off old phone network

5.<br>Hulk, Punisher join Peter Parker in Spider-Man: Brand New Day trailer

Customize