Windows Clipper Worm Phones Home Over Tor, Swaps Crypto Wallets via ActiveX
Microsoft says the campaign, active since February, uses USB-borne LNK files and Windows Script Host to drop a bundled Tor proxy that talks to a .onion C2.
A Windows-targeted cryptocurrency clipper has been quietly swapping wallet addresses on victim clipboards since February 2026, and the delivery chain is straight out of the early-2010s playbook — with a 2026 twist.
Microsoft's Defender Security Research Team published an analysis Tuesday detailing the campaign, which spreads through USB-borne LNK shortcut files and pulls command-and-control traffic through a bundled Tor proxy.
The shape of it is unusual. Clippers are typically dumb. This one isn't.
According to the writeup, the malware "relies on Windows Script Host and ActiveX-driven logic to launch a bundled Tor proxy and poll a hidden-service C2 server." Translation: rather than hardcoding a fresh attacker wallet into the binary, the clipper periodically beacons to a .onion address and asks what address to substitute when it spots a crypto wallet string on the clipboard.
That design gives the operators something most clippers lack — runtime agility. New wallets can be rotated server-side without redeploying the payload. If one address gets flagged on chain analytics, swap it. The infected host never notices.
The LNK worm component handles propagation. When a user plugs in a USB drive, the shortcut executes a WSH script that stages the ActiveX loader and the Tor client. From there, the host is recruited into the polling loop.
A few things worth flagging for defenders.
Windows Script Host abuse is older than most SOC analysts, and it remains absurdly effective on endpoints where wscript.exe and cscript.exe aren't constrained. AppLocker or WDAC policies that block script interpreters from non-trusted paths would kill this chain before the Tor proxy ever launches. So would disabling autorun behavior on removable media, which Microsoft has technically defaulted off for years but which group policy regularly re-enables in enterprise images.
MFA, in case anyone is wondering, would not have helped here. This isn't an auth problem. It's a code-execution-on-endpoint problem, and the theft happens at the clipboard layer, well after any identity decision has been made. Worth saying out loud because clipper coverage tends to get lumped in with credential theft, and the controls don't overlap.
The Tor angle does complicate takedown. Hidden services are resilient by design, and there's no registrar to lean on. Defenders should treat outbound connections to localhost SOCKS proxies spawned by script hosts as a high-fidelity signal — that pattern has almost no legitimate use on a corporate endpoint.
Indicators of compromise, including LNK hashes and the Tor client binary fingerprint, are in the Microsoft writeup. If you allow USB mass storage in your environment, hunt now. If you don't, hunt anyway. Contractors carry drives.
