Microsoft warns of USB worm-like malware utilizing Tor for stealth

Microsoft has recognized a cryptocurrency clipper malware marketing campaign, lively since February 2026, that mixes USB-based propagation, a Tor-hidden command-and-control infrastructure, and distant code execution capabilities.

The malware steals cryptocurrency seed phrases and personal keys whereas silently changing pockets addresses copied to the clipboard with attacker-controlled options.

Microsoft discovered that the menace goes past conventional crypto-clippers, functioning as each a cryptocurrency stealer and a light-weight backdoor. By bundling its personal Tor consumer and speaking completely by hidden .onion providers, the malware conceals its infrastructure whereas sustaining persistent entry to contaminated units.

Microsoft said infections start by malicious Home windows shortcut (.lnk) recordsdata distributed on USB storage units. As soon as executed, the malware installs two parts: a worm that spreads to extra detachable drives and a clipper module designed to reap and exfiltrate cryptocurrency-related knowledge.

USB-based propagation

The worm part scans related USB units for generally used paperwork, together with Phrase, Excel, and PDF recordsdata. The unique recordsdata are hidden and changed with malicious shortcut recordsdata that share the identical names, making it tough for customers to differentiate legit paperwork from malware-laced shortcuts.

When victims open one in all these shortcuts, the malware deploys extra payloads underneath randomly named folders in C:UsersPublicDocuments and establishes persistence utilizing scheduled duties. It additionally makes an attempt to evade detection by creating antivirus exclusions for its staging directories and execution recordsdata.

Researchers famous that each one malware parts are closely obfuscated. The installer is packaged utilizing PyInstaller and guarded with PyArmor, whereas the JavaScript-based payloads use a number of layers of encryption and runtime decryption to hinder evaluation.

Earlier than activating, the malware performs a easy anti-analysis examine by searching for Home windows Process Supervisor processes and terminating itself if one is detected.

Knowledge theft and distant code execution

The clipper part depends on Home windows Script Host and ActiveX objects to work together with the working system. After launching a bundled Tor consumer named ugate.exe, it waits for the community connection to initialize earlier than registering the contaminated system with a hidden-service command-and-control server.

The malware then repeatedly polls its operators for directions whereas monitoring clipboard contents roughly each 500 milliseconds. Microsoft noticed the malware looking for cryptocurrency seed phrases, Ethereum personal keys, Bitcoin Pockets Import Format (WIF) personal keys, and pockets addresses.

Captured seed phrases and personal keys are transmitted to attackers by Tor-routed communications. The malware additionally captures screenshots at common intervals and uploads them to supply extra context concerning the sufferer’s cryptocurrency exercise.

Like many crypto clippers, the malware hijacks transactions by changing copied pockets addresses with attacker-controlled options. Microsoft discovered help for a number of cryptocurrency codecs, together with Bitcoin, Monero, and Tron addresses. To scale back the probability of detection, alternative addresses are crafted to partially resemble the originals by matching particular main or trailing characters.

Researchers additionally found an EVAL command that permits operators to obtain and execute arbitrary JavaScript code from the command-and-control server. This functionality successfully transforms the malware from a easy cryptocurrency stealer into a light-weight backdoor that may execute extra payloads on compromised methods.

Defenders ought to monitor for suspicious use of WScript, PowerShell-based screen-capture exercise, Tor visitors routed by localhost:9050, clipboard-inspection conduct, and strange curl.exe executions with SOCKS5 proxy parameters.

Organizations are suggested to disable AutoRun and AutoPlay on detachable media, prohibit execution of .lnk recordsdata from USB drives the place doable, restrict pointless use of script interpreters reminiscent of wscript.exe and cscript.exe, and examine methods exhibiting native Tor proxy exercise.