A newly discovered cryptocurrency clipper malware has been quietly stealing digital assets from victims since February 2026, spreading through a trick that most users would never suspect: weaponized Windows shortcut files on USB drives.

The malware is not just a simple thief. It comes with worm-like behavior, Tor-based communication, and the ability to execute remote commands, making it one of the more sophisticated financially motivated threats seen this year.

The attack begins the moment someone plugs in an infected USB drive and clicks on what looks like a familiar document. Unknown to the user, the file is actually a malicious shortcut (.lnk) that silently launches harmful payloads in the background.

The malware hides the original files, replaces them with look-alike shortcuts, and waits for unsuspecting users on other machines to fall into the same trap.

Analysts from Microsoft Threat Intelligence and Microsoft Defender Experts identified this campaign and noted it has been actively targeting users for several months.

Microsoft said in a report shared with Cyber Security News (CSN) that the malware carries out high-frequency clipboard theft, screenshot exfiltration, and wallet-address substitution, all while routing its traffic through the Tor network.

The threat leaves very little trace in the traditional sense. There is no standard installer, no exposed IP address to block, and the core payloads are encrypted and only unpacked at the moment of execution. This preparation suggests the people behind this campaign put significant effort into staying hidden.

High level execution flow (Source - Microsoft) — High level execution flow (Source – Microsoft)

The financial damage can be immediate and severe. By quietly swapping copied wallet addresses with attacker-controlled ones, it can redirect entire cryptocurrency transactions without the victim noticing until the funds are already gone.

Hackers Use Weaponized Windows Shortcuts

The malware’s delivery method is deceptively simple. When a USB drive is inserted into an infected machine, the worm scans it for common file types like .doc, .xlsx, and .pdf. It hides the originals and creates shortcut versions with the same names, trapping the next person who picks up the drive.

Once a victim clicks one of those shortcuts, the worm drops two malicious JavaScript files into a subfolder under “C:\Users\Public\Documents” using a five-character naming pattern for both the folder and file names.

It also creates two scheduled tasks to keep the stealer running and the worm spreading to any new USB device connected to the machine.

The installation is wrapped in multiple layers of obfuscation. The initial payload is a Python script protected with PyArmor and packaged into a standalone executable, while the JavaScript files each carry dual-layer obfuscation.

CheckC2Command function (Source - Microsoft) — CheckC2Command function (Source – Microsoft)

The malware also terminates itself if Task Manager is detected, making manual inspection significantly harder.

Tor-Routed Command and Control and Clipboard Theft

At the heart of this malware is a portable Tor client renamed “ugate.exe” that launches in a hidden window.

Once Tor is running, the malware communicates with its command server entirely through .onion addresses, making it nearly impossible to block based on destination domain alone.

The clipper monitors the clipboard roughly every 500 milliseconds, looking for seed phrases, private keys, and wallet addresses.

When it spots a copied wallet address, it silently replaces it with one controlled by the attacker. Supported formats include Bitcoin legacy, P2SH, Taproot, Bech32, Tron, and Monero addresses.

The malware also captures five screenshots in ten-second intervals and sends them back to the attacker over Tor. This gives the operator a fuller picture of what the victim is doing with their funds.

An EVAL command from the server can also push arbitrary code to run directly on the victim’s machine.

Defenders are strongly advised to disable AutoRun and AutoPlay for all removable media and to block .lnk execution from USB drives through Group Policy.

Restricting script interpreters like wscript.exe and cscript.exe where not needed, and hunting for SOCKS5 proxy traffic on localhost:9050, are key steps to catching this threat early.

Reviewing clipboard and screen-capture behaviors on devices handling financial workflows is equally important.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
SHA-256	7630debd35cac6b7d58c4427695579b3e3a8b1cc462f523234cd6c698882a68c	Crypto Clipper Worm
SHA-256	a7abf1d9d6686af1cefcd60b17a312e7eb8cfe267def1ec34aeab6128c811630	Crypto Clipper Worm
SHA-256	23c1e673f315dafa14b73034a90dd3d393a984451ff6601b8be8142be6487b43	Crypto Clipper Worm
SHA-256	cf9fc891ea5ca5ecd8113ef3e69f6f52ff538b6cccbdaa9559106fc72bc6da30	Crypto Clipper Worm
SHA-256	100407796028bf3649752d9d2a67a0e4394d752eb8de86daa42920e814f3fae8	Crypto Clipper Worm
SHA-256	d14b80cbd1a19d4ad0473a0661297f8fdf598e81ff6c4ab24e212dcad2e54b3f	Crypto Clipper Worm
SHA-256	9d90f54ae36c6c5435d5b8bed40faf54cc91f6db28574a6310b5ffaeb0362e96	Crypto Clipper Worm
SHA-256	67fc5cf395e28294bbb91ed0e954fdf2e80ebd9119022a115a42c286dc8bacf5	Crypto Clipper Worm
SHA-256	0020d23b0f9c5e6851a7f737af73fd143175ee47054931166369edd93338538a	Crypto Clipper Worm
SHA-256	35a6bc44b176a050fd6824904b7604f0f45b0fdfa26bf9500b9e05973b387cfd	Crypto Clipper Worm
SHA-256	c824630154ac4fdfce94ded01f037c305eab51e9bef3f493c60ff3184a640502	Crypto Clipper Worm
SHA-256	d43bf94f0cb0ab97c88113b7e07d1a4024d1610617b5ad05882b1dbab89e15ba	Crypto Clipper Worm
SHA-256	b2777b73a4c33ac6a409d475057843be6b5d32262ef28a1f1ff5bb52e3834c5f	Crypto Clipper Worm
SHA-256	7787a9a7d8ae393aa32f257d083903c4dc9b97a1e5b0458c4cd480d4f3cb5b05	Crypto Clipper Worm
SHA-256	f3b54984caca95fd496bcfe5d7db1611b08d2f5b7d250b43b430e5d76393f9e0	Crypto Clipper Worm
SHA-256	20db98af3037b197c8a846dbf17b87fc6f049c3e0d9a188f9b9a74d3916dd5e1	Crypto Clipper Worm
Filename	ugate.exe	Portable Tor binary
Domain	cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad.onion	C2 domain
Domain	gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad.onion	C2 domain
Domain	he5vnov645txpcv57el2theky2elesn24ebvgwfoewlpftksxp4fnxad.onion	C2 domain
Domain	lyhizqy2js2eh6ufngkbzntouiikdek5zsdj3qwa22b4z6knpqorgiad.onion	C2 domain
Domain	j3bv7g27oramhbxxuv6gl3dcyfmf44qnvju3offdyrap7hurfprq74qd.onion	C2 domain
Domain	shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion	C2 domain
Domain	7goms4byw26kkbaanz5a5u5234gusot7rp5imzc3ozh66wwcvmcudjid.onion	C2 domain
Domain	facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion	C2 domain
Domain	wt26llpl5k6gok3vnaxmucwgzv2wk3l7nuibbh25clghrtus3p5ctsid.onion	C2 domain
Domain	ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion	C2 domain

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Use Weaponized Windows Shortcuts to Spread Crypto Clipper Across USB Drives appeared first on Cyber Security News.