Security AffairsPierluigi Paganini
Tor based clipboard malware steals crypto via USB shortcuts
Part of the clipboard story · since 17 Jun
- Wed 17 Jun, 13:48 UTC. Check Point, first report. Rust clipboard hijacker steals crypto through fake GitHub apps.
- Thu 18 Jun, 00:47 UTC. Microsoft, its first report on the story. Windows crypto clipper malware hijacks clipboard via Tor.
- Thu 18 Jun, 15:07 UTC. Infosecurity, its first report on the story. Fake GitHub stars drive crypto clipboard hijacker malware.
- Thu 18 Jun, 19:00 UTC. Security Affairs, its first report on the story. Tor based clipboard malware steals crypto via USB shortcuts. This article, 4th of 7.
- Fri 19 Jun, 00:05 UTC. Ars Technica, its first report on the story. New USB Spread Crypto Clipper malware hijacks wallets via Tor.
- Mon 22 Jun, 16:50 UTC. Dark Reading, its first report on the story. Fake reputation scam spreads clipboard hijacker to steal crypto.
- Wed 24 Jun, 09:30 UTC. SecurityOnline, its first report on the story. Crypto Clipboard Hijacker Hides Behind Fake Stars and Upvotes.
A new Tor-based clipboard-stealing malware, referred to as a clopper, has emerged targeting cryptocurrency wallets. Microsoft Threat Intelligence has tracked this campaign since February 2026. The malware spreads via malicious .lnk files on USB drives, disguising itself as legitimate documents, and utilizes the Tor network to exfiltrate stolen data without revealing its command server IP.
It captures sensitive data like wallet addresses and BIP39 seed phrases by replacing clipboard contents with attacker-controlled addresses. Additionally, the malware takes screenshots every 10 seconds to monitor user activity. Defense strategies include monitoring specific Windows processes and blocking .lnk executions from removable drives.
How the story developed
7 articles from 7 outlets since 17 Jun. Quiet since 24 Jun. This was the 4th report, 1 day after the first.
- Wed 17 Jun, 13:48 UTC. Check Point, first report. Rust clipboard hijacker steals crypto through fake GitHub apps.
- Thu 18 Jun, 00:47 UTC. Microsoft, its first report on the story. Windows crypto clipper malware hijacks clipboard via Tor.
- Thu 18 Jun, 15:07 UTC. Infosecurity, its first report on the story. Fake GitHub stars drive crypto clipboard hijacker malware.
- Thu 18 Jun, 19:00 UTC. Security Affairs, its first report on the story. Tor based clipboard malware steals crypto via USB shortcuts. This article, 4th of 7.
- Fri 19 Jun, 00:05 UTC. Ars Technica, its first report on the story. New USB Spread Crypto Clipper malware hijacks wallets via Tor.
- Mon 22 Jun, 16:50 UTC. Dark Reading, its first report on the story. Fake reputation scam spreads clipboard hijacker to steal crypto.
- Wed 24 Jun, 09:30 UTC. SecurityOnline, its first report on the story. Crypto Clipboard Hijacker Hides Behind Fake Stars and Upvotes.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Wed 17 JunDay 01
- Rust clipboard hijacker steals crypto through fake GitHub apps13:48 · Check Point · First report
- Thu 18 JunDay 13
- Windows crypto clipper malware hijacks clipboard via Tor00:47 · Microsoft
- Fake GitHub stars drive crypto clipboard hijacker malware15:07 · Infosecurity
- Tor based clipboard malware steals crypto via USB shortcuts19:00 · Security Affairs · This article, 4th of 7
- Fri 19 JunDay 21
- New USB Spread Crypto Clipper malware hijacks wallets via Tor00:05 · Ars Technica
Quiet for 4 days
Mon 22 JunDay 51- Fake reputation scam spreads clipboard hijacker to steal crypto16:50 · Dark Reading · Picked up again
Quiet for 2 days
Wed 24 JunDay 71- Crypto Clipboard Hijacker Hides Behind Fake Stars and Upvotes09:30 · SecurityOnline