Microsoft: Clipper malware campaign targets Windows

Microsoft has revealed details of a Windows Clipper malware campaign that has been targeting users since February 2026. The clipper in this campaign relies on Windows Script Host and ActiveX -driven logic to launch an embedded Tor proxy and communicate with a hidden command and control (C2) server. It performs high-frequency clipboard theft, screenshot extraction, and wallet address replacement.

See also: Microsoft blocks Windows 11 24H2 on PCs with USB scanners

The execution of this clipper malware is notable because it does not rely on a traditional installer or exposed IP-based C2 infrastructure. Instead, it deploys a portable Tor client, routes traffic through a local SOCKS5 proxy , and combines data theft with remote code execution, turning a financially motivated thief into a backdoor.

Clipper malware refers to a type of malware that silently monitors a user's clipboard and intercepts sensitive data pasted into the temporary buffer. It primarily targets cryptocurrency transactions by replacing wallet address strings that match known blockchain address patterns to redirect them to addresses under their control.

The attacks involve distributing a malicious Windows shortcut file (LNK) via USB storage devices. Opening this file activates a worm component that checks if the machine is already infected and proceeds to download the payload from a remote server only if it is not present. A second module being deployed is the clipper that collects and extracts cryptocurrency wallet information.

The LNK payload scans the USB device for common document types such as DOC, XLSX , and PDF. If found, it hides them and creates new LNK files with the same file names, containing arguments associated with the worm. Thus, when an unsuspecting user launches the shortcut thinking that it is opening a harmless document, the malware is triggered to execute.

See also: Microsoft silently fixes Windows LNK error

The worm, in addition to ensuring propagation to other uninfected USB drives, deploys scheduled tasks as a form of persistence for both the worm and the stealer. The clipper malware uses WScript and ActiveXObject to interact with the operating system and terminates itself if Task Manager is in the list of actively running processes to avoid detection.

In the final stage, the malware launches a renamed Tor binary in a hidden window, generates a unique victim identifier, and registers it with the external server. Once this step is complete, the malware enters a continuous loop, periodically checking the C2 server for instructions while simultaneously monitoring the clipboard approximately every 500 milliseconds to extract seed phrases and private keys.

It also hijacks cryptocurrency addresses by replacing copied wallet values ​​with attacker-controlled alternatives and uploads screenshots over Tor. If the C2 returns an EVAL response, the malware executes code provided by the attacker at runtime.

Microsoft has suggested that defenders prioritize behavioral detections over static signatures, specifically looking for PowerShell-based screen captures and the use of WScript, CScript, or related script engines to launch curl, cmd.exe, PowerShell, or unexpected executables.

See also: Windows returns to the Microsoft menu

Other mitigation measures include disabling AutoRun/AutoPlay for all removable media, blocking LNK execution from removable drives via Group Policy Objects (GPOs), limiting unnecessary use of wscript.exe or cscript.exe, and reviewing behaviors related to clipboard and screen recording on devices handling sensitive financial workflows.