Clipper worm that spreads by USB and steals seeds crypto via Tor: the new threat it puts in check to digital portfolios

A new malicious campaign has revealed that the attackers continue to exploit physical vectors and stealth techniques to empty cryptocarteas: it is a self-spreading clipper that spreads through LNK files on USB drives and uses the Tor network to hide their communication with the command and control server.

According to the public analysis of Microsoft researchers, the initial mechanism is simple but effective: the user opens a direct access (.LNK) in a removable drive and that access triggers malware execution. The code then looks for documents, hides the originals and replaces them with malicious shortcuts with the same name, which causes new infections every time someone tries to open those files. In addition, malware creates a scheduled task that monitors the connection of USB drives to copy and spread those shortcuts automatically, acting like a local worm.

The most dangerous part is oriented to digital assets: a "stealer" component checks the clipboard each second and replaces the addresses of the purse and keys / seed phrases with addresses controlled by the attacker. Specific formats (BIP39 of 12 and 24 words, private keys of Ethereum and Bitcoin in different formats, Tron and Monero addresses, among others) are pointed out and the replacement addresses are designed to be partially similar to the original ones, reducing the possibility of visual detection by the user. The malware also takes regular screenshots and exfiltrates them using the included Tor client, and supports remote instructions that allow you to download and run JavaScript code on the infected computer.

The implications for those who handle cryptoforeign exchange are clear and severe: no reverse transaction guarantees recovery of funds if a key or seed has been compromised, especially when attackers use quick transfer mechanisms and mixers or private cryptomonedas. In addition, the USB propagation capacity makes this threat a risk for poorly managed "air-gapped" environments and for organizations with lax policies on removable devices.

From the operational point of view, the campaign is stealth: it avoids running actions if the task manager is active, relies on wscript / cscript and utilities such as curl and PowerShell for lateral movement and exfiltration, and creates local Tor traffic (e.g. connections to localhost: 9050) to mask .onion. destinations. That's why the most reliable indicators are behavioral and not so much static file signatures.

For private users the first recommendation is do not connect or open files from unknown USB. If you drive cryptomonedas, always use hardware portfolios (cold wallets) to sign transactions and check the address on the device screen before confirming. Avoid copying and paste addresses from the clipboard for critical operations; when possible, use QR or the direction verification function of the hardware walk. Keep your seed phrases out of connected and written devices only in safe physical media.

For security teams and administrators, technical countermeasures include disabling automatic execution and blocking the execution of direct access from removable means, implementing white list policies (AppLocker or WDAC) to prevent the execution of unauthorized binaries, and disabling Windows Script Host if not necessary. It is also crucial to create behavioural-based detection rules: alerts for unexpected executions of wscript.exe / cscript.exe that launch curl or PowerShell, for the creation of programmed tasks that monitor removable devices, and for connections to localhost: 9050 that indicate use of a local Tor proxy. You can expand your exam with search for newly created LNK files and hidden files that accompany supposedly legitimate documents.

If you suspect an infection, isolate the network equipment, remove USB units and preserve forensic images before proceeding. Review scheduled tasks, unusual child processes and command line history; search for executables with suspicious names and presence of a packaged Tor client. If there is confirmation of commitment of keys or seeds, consider moving funds from the affected addresses to new portfolios created on public and safe devices; take into account that, in many cases, the recovery of funds is not possible without judicial aid or cooperation from intermediate platforms.

Organizations should complement preventive defence with controlled offensive evidence (break & attack simulation) and regular EDR / IMS reviews: simulate attempts at execution from removable means to validate rules of detection and adjustment alert by behaviour before an attacker exploits them in real environments. Microsoft publishes a technical report with IoC and recommendations that should be reviewed to adjust signatures and detection rules: Microsoft technical report.

It is also useful to understand how attackers use anonymity channels: the Tor network is used here to host payloads and to exfilter data, which makes traceability difficult and slow down the response. To better understand the nature of this network and how to identify its use in your environment, see public information on the Tor project: The Tor Project. And if you need to disable scribing components for security reasons, Microsoft keeps documentation on how to disable Windows Script Host in a controlled way: Microsoft guide.

In short, this campaign is a mix of old techniques (USB and direct access) with modern stealth controls (Tor, Screenshot exfiltration, analysis evasion), making it dangerous for users and organizations that treat digital assets. Effective defense requires combining digital user hygiene, technical controls on endpoints and behavior-based monitoring to detect and block the attack chain before the loss of funds materializes.