Key facts
- Microsoft has discovered a new malware strain.
- The malware is named Crypto Clipper.
- Crypto Clipper targets cryptocurrency.
- The malware spreads via malicious shortcut files on USB drives.
- It monitors clipboards for cryptocurrency wallet addresses.
- It replaces legitimate wallet addresses with attacker-controlled ones.
- The malware uses the Tor network for communication.
Microsoft has discovered a new cryptocurrency-stealing malware, identified as Crypto Clipper, which is being distributed via malicious shortcut files on USB drives. This malware is designed to compromise cryptocurrency transactions by actively monitoring a user's clipboard. When a cryptocurrency wallet address is detected, Crypto Clipper replaces the legitimate address with an attacker-controlled address. This malicious substitution ensures that any funds intended for the user are instead sent to the attackers. To maintain stealth and evade detection, the malware employs the Tor network for its communication infrastructure. This allows it to communicate with its command-and-control servers anonymously, making attribution and disruption efforts more challenging for cybersecurity professionals.