CryptoBandits Malware: How Clipboard Hijacking, Tor C2, and USB Propagation Are Draining Crypto Wallets

On June 17, 2026, Microsoft disclosed a Windows-based cryptocurrency clipper campaign active since February 2026, tracked with CryptoBandits-related detections . The malware combines clipboard hijacking, seed phrase and private key theft, a bundled Tor proxy, and worm-like USB propagation to steal cryptocurrency across connected and air-gapped environments .

Key details of the CryptoBandits campaign

• Clipboard-hijacking mechanism: The malware runs as a script-based payload via WScript and ActiveXObject . It monitors the clipboard roughly every 500 milliseconds, replacing copied cryptocurrency wallet addresses such as Bitcoin, Ethereum, Tron, Monero, and others with attacker-controlled addresses . It also extracts seed phrases and private keys matching wallet-related patterns .

• Tor-based C2 evasion: The malware launches a renamed Tor binary (ugate.exe) in a hidden window, waits about 60 seconds for Tor to bootstrap, generates a victim GUID, and registers the infected device with a hidden-service command-and-control server . C2 communication flows through the local Tor SOCKS5 proxy on localhost:9050, helping avoid conventional IP-based infrastructure .

• Worm-like USB propagation: Initial infection occurs through malicious .lnk shortcut files distributed on USB storage devices . The .lnk stages a worm component that checks for existing infection and, if absent, fetches the payload from the C2 over Tor . This mechanism can allow the malware to spread across air-gapped environments when infected USB drives are moved between machines .

• Additional capabilities: The malware uploads screenshots through Tor and can execute arbitrary attacker-supplied code at runtime if the C2 returns an EVAL response .

Detection recommendations from Microsoft Defender Experts

Microsoft Defender Experts recommend the following mitigations and hunting steps :

• Disable AutoRun/AutoPlay for all removable media .
• Block .lnk execution from removable drives via Group Policy .
• Restrict unnecessary use of wscript.exe and cscript.exe .
• Enable Attack Surface Reduction rules focused on obfuscated script execution and suspicious child-process behavior .
• Investigate script-to-network chains involving curl, PowerShell, or cmd.exe .
• Hunt for local SOCKS5 proxy activity on localhost:9050 .
• Review clipboard-related and screen-capture behaviors on devices handling sensitive financial workflows .

Broader context: rising clipper malware activity in 2026

The CryptoBandits campaign fits into a broader set of reported cryptocurrency clipper and clipboard-hijacking activity . Other notable clipper operations reported around this period include:

• CountLoader: A multi-stage campaign using JavaScript, PowerShell, and shellcode to distribute a clipper payload .
• Rust-based clipboard hijackers: Distributed through phishing pages, GitHub, SourceForge, and manipulated YouTube content .
• Python-based clippers: Distributed via Discord as Pro.exe / peeek.exe .
• Linux-focused clippers: Such as "ClipXDaemon," an autonomous X11 clipboard hijacker identified in February 2026 .

Taken together, these reports show clipper malware activity spanning script-driven Windows payloads, Tor-enabled infrastructure, USB-based propagation, social-platform distribution, and Linux-focused clipboard hijacking .