Crypto Clipper uses Tor and worm-like propagation for persistence and control
2026-06-18T02:52:14Z•4d4e22aa7b346a1d271b141537f52dc2638e2eba43c6eaf704f9e539eb9fa22f
backdoorclipboard-theftcrypto-clippercryptocurrency-theftmalwaremicrosoft-threat-intelligencepersistencetor-c2wallet-replacementworm-like-propagation
What happened
Microsoft Threat Intelligence analyzed a cryptocurrency clipper campaign that steals clipboard contents and replaces crypto wallet addresses to divert funds. The malware uses Tor for command-and-control, implements worm-like propagation to achieve persistence and lateral spread, and includes a lightweight backdoor to enable follow-on activity and remote control.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 4d4e22aa7b346a1d271b141537f52dc2638e2eba43c6eaf704f9e539eb9fa22f
- Enrichment time
- 2026-06-18T02:52:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.