MicrosoftMicrosoft Defender Security Research Team and Microsoft Defender Experts
Windows crypto clipper malware hijacks clipboard via Tor
Part of the clipboard story · since 17 Jun
- Wed 17 Jun, 13:48 UTC. Check Point, first report. Rust clipboard hijacker steals crypto through fake GitHub apps.
- Thu 18 Jun, 00:47 UTC. Microsoft, its first report on the story. Windows crypto clipper malware hijacks clipboard via Tor. This article, 2nd of 7.
- Thu 18 Jun, 15:07 UTC. Infosecurity, its first report on the story. Fake GitHub stars drive crypto clipboard hijacker malware.
- Thu 18 Jun, 19:00 UTC. Security Affairs, its first report on the story. Tor based clipboard malware steals crypto via USB shortcuts.
- Fri 19 Jun, 00:05 UTC. Ars Technica, its first report on the story. New USB Spread Crypto Clipper malware hijacks wallets via Tor.
- Mon 22 Jun, 16:50 UTC. Dark Reading, its first report on the story. Fake reputation scam spreads clipboard hijacker to steal crypto.
- Wed 24 Jun, 09:30 UTC. SecurityOnline, its first report on the story. Crypto Clipboard Hijacker Hides Behind Fake Stars and Upvotes.
The content discusses a newly identified Windows-based cryptocurrency clipper malware that has been affecting users since February 2026. This malware employs clipboard data theft to acquire valuable cryptocurrency information. It uniquely utilizes a portable Tor client for command and control, bypassing traditional detection methods. Key behaviors include high-frequency clipboard monitoring, screenshot capture, and wallet address substitution.
The malware propagates via malicious shortcut files and establishes persistence through scheduled tasks. Microsoft Defender provides detection capabilities for this threat, focusing on abnormal behaviors related to script executions and network activity. Mitigation recommendations emphasize behavioral detection, reduction of script execution paths, and monitoring for suspicious proxy usage. The document also highlights the importance of hardening defenses against such lightweight, script-based threats.
How the story developed
7 articles from 7 outlets since 17 Jun. Quiet since 24 Jun. This was the 2nd report, 11 hours after the first.
- Wed 17 Jun, 13:48 UTC. Check Point, first report. Rust clipboard hijacker steals crypto through fake GitHub apps.
- Thu 18 Jun, 00:47 UTC. Microsoft, its first report on the story. Windows crypto clipper malware hijacks clipboard via Tor. This article, 2nd of 7.
- Thu 18 Jun, 15:07 UTC. Infosecurity, its first report on the story. Fake GitHub stars drive crypto clipboard hijacker malware.
- Thu 18 Jun, 19:00 UTC. Security Affairs, its first report on the story. Tor based clipboard malware steals crypto via USB shortcuts.
- Fri 19 Jun, 00:05 UTC. Ars Technica, its first report on the story. New USB Spread Crypto Clipper malware hijacks wallets via Tor.
- Mon 22 Jun, 16:50 UTC. Dark Reading, its first report on the story. Fake reputation scam spreads clipboard hijacker to steal crypto.
- Wed 24 Jun, 09:30 UTC. SecurityOnline, its first report on the story. Crypto Clipboard Hijacker Hides Behind Fake Stars and Upvotes.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Wed 17 JunDay 01
- Rust clipboard hijacker steals crypto through fake GitHub apps13:48 · Check Point · First report
- Thu 18 JunDay 13
- Windows crypto clipper malware hijacks clipboard via Tor00:47 · Microsoft · This article, 2nd of 7
- Fake GitHub stars drive crypto clipboard hijacker malware15:07 · Infosecurity
- Tor based clipboard malware steals crypto via USB shortcuts19:00 · Security Affairs
- Fri 19 JunDay 21
- New USB Spread Crypto Clipper malware hijacks wallets via Tor00:05 · Ars Technica
Quiet for 4 days
Mon 22 JunDay 51- Fake reputation scam spreads clipboard hijacker to steal crypto16:50 · Dark Reading · Picked up again
Quiet for 2 days
Wed 24 JunDay 71- Crypto Clipboard Hijacker Hides Behind Fake Stars and Upvotes09:30 · SecurityOnline