Windows Clipper Worm Phones Home Over Tor, Swaps Crypto Wallets via ActiveX
Microsoft says the campaign, active since February, uses USB-borne LNK files and Windows Script Host to drop a bundled Tor proxy that talks to a .onion C2.
Key points
- A Windows cryptocurrency clipper active since February 2026 swaps wallet addresses on victim clipboards by querying a Tor hidden-service C2.
- Delivery relies on USB-borne LNK shortcut files that execute a Windows Script Host script, staging an ActiveX loader and a bundled Tor client.
- Operators can rotate attacker wallets server-side without redeploying the payload, a design most clippers skip.
- Outbound connections to localhost SOCKS proxies spawned by script hosts are a high-fidelity detection signal with almost no legitimate use on corporate endpoints.
- AppLocker or WDAC policies blocking script interpreters from non-trusted paths break the chain before the Tor proxy launches.
A Windows-targeted cryptocurrency clipper has been quietly swapping wallet addresses on victim clipboards since February 2026, and the delivery chain borrows from the early-2010s playbook.
Microsoft's Defender Security Research Team published an analysis Tuesday detailing the campaign, which spreads through USB-borne LNK shortcut files and routes command-and-control traffic through a bundled Tor proxy.
Clippers are typically dumb. This one isn't.
The malware, according to the writeup, "relies on Windows Script Host and ActiveX-driven logic to launch a bundled Tor proxy and poll a hidden-service C2 server." Rather than hardcoding an attacker wallet into the binary, the clipper beacons periodically to a .onion address and requests a substitute wallet string whenever it spots a cryptocurrency address on the clipboard. New wallets rotate server-side. If one gets flagged by chain analytics, the operators swap it without touching the payload.
How does it spread?
The LNK worm component handles propagation. Plugging in a USB drive triggers the shortcut, which executes a WSH script that stages the ActiveX loader alongside the Tor client, then recruits the host into the polling loop. This is the same LNK-over-USB mechanic we flagged on 17 June when a separate clipper crew was seeding trojanized crypto tools through paid press placements: different delivery surface, same clipboard-layer theft at the end of it.
Should you worry?
If USB mass storage is permitted in your environment, yes. Hunt now. Contractors carry drives regardless of policy.
Windows Script Host abuse is older than most SOC analysts and remains effective wherever wscript.exe and cscript.exe run unconstrained. AppLocker or WDAC policies that block script interpreters from non-trusted paths kill this chain before the Tor proxy ever launches. Disabling autorun on removable media matters too: Microsoft defaulted it off years ago, but group policy regularly re-enables it in enterprise images.
MFA would not have helped. This is a code-execution-on-endpoint problem. The theft happens at the clipboard layer, well after any identity decision, and clipper coverage that folds this into credential-theft guidance sends defenders toward the wrong controls entirely.
The Tor angle complicates takedown: hidden services have no registrar to lean on. Treat outbound connections to localhost SOCKS proxies spawned by script hosts as a detection priority.
Indicators of compromise, including LNK hashes and the Tor client binary fingerprint, are in the Microsoft writeup.
