Loading story…
Microsoft disclosed an active Windows cryptocurrency theft campaign that spreads through malicious .lnk shortcut files, often delivered via USB devices, and combines worm-like propagation with a script-based clipper and stealer. The malware has been active since February 2026 and uses Windows Script Host, ActiveX, and a bundled Tor client to reach hidden-service command-and-control infrastructure through localhost:9050, avoiding conventional installer and IP-based infrastructure. Microsoft said the threat is detected as Trojan:Win32/CryptoBandits.A and related CryptoBandits signatures.
Once installed, the malware monitors the clipboard roughly every 500 milliseconds for BIP39 seed phrases, Ethereum keys, Bitcoin WIF keys, and wallet addresses, then replaces copied cryptocurrency addresses with attacker-controlled ones while also stealing screenshots. Microsoft said the operators added persistence through scheduled tasks, Defender exclusions, layered obfuscation, and packaging with PyArmor and PyInstaller, while also terminating execution if Task Manager is detected. The campaign also supports remote code execution through an EVAL command from its C2, effectively giving the operators lightweight backdoor access; defenders were urged to block .lnk execution from removable media, restrict script hosts, and hunt for suspicious script activity, clipboard inspection, curl-based exfiltration, PowerShell screen capture, and Tor SOCKS5 traffic over localhost:9050.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft Threat Intelligence and Microsoft Defender Experts reported a Windows-based cryptocurrency clipper campaign that has been active since February 2026. The campaign spreads via malicious .lnk files, often on USB devices, and includes worm-like propagation and persistence features.
On 2026-06-17, Microsoft published technical details on the campaign, describing its use of Windows Script Host, ActiveX, a bundled Tor client, clipboard theft, wallet address replacement, screenshot exfiltration, and remote code execution via an EVAL command. Microsoft also shared detection guidance and noted Defender detections for the malware family.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcexakep.ru
Open sourcesecurityweek.com
Open sourcecybersecuritynews.com
Open sourcecysecurity.news
Open sourcecommunity.gurucul.com
Open sourcemalware.news
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malware campaign has been distributing Rust-based cryptocurrency clipboard hijackers for **Windows** and **macOS** by masquerading as crypto trading bots, Solana and Pump.fun sniper bots, Aviator Predictor, and other crash-game predictor tools. Researchers said the operation used a WordPress phishing site as a central hub and boosted credibility through coordinated promotion on **GitHub**, **SourceForge**, **YouTube**, crypto forums, and even posts placed on legitimate news websites, targeting crypto holders, traders, and gamblers seeking quick profits or unfair advantages. On Windows, a **.NET** loader deployed a Rust clipper that stored files under `%APPDATA%`, created Startup shortcut persistence, and swapped copied wallet addresses with attacker-controlled ones from an embedded list of more than **15,500** addresses. On macOS, victims were guided through a loader and an "unlocker" script to bypass **Gatekeeper**, after which a Rust clipper installed **LaunchAgent** persistence and a self-healing watchdog. The activity was linked across platforms through the Telegram handle and WordPress author name `@JoseCmanXD`, while the operators also manipulated **VirusTotal** community sentiment with benign votes and "safe" comments; attacker-controlled wallets reportedly received multiple transactions, indicating successful theft.
Jun 29, 2026
Cyble researchers reported a newly identified Linux malware family, **ClipXDaemon**, that targets X11 desktop sessions by continuously monitoring clipboard contents (about every **200 ms**) and covertly replacing copied cryptocurrency wallet addresses with attacker-controlled ones to divert funds. The malware is designed to operate **without command-and-control (C2) infrastructure**, enabling direct monetization while reducing network-based detection opportunities; it uses standard **X11 APIs** to connect to the X server and perform clipboard tracking and manipulation. Infections were observed starting from a loader whose structure resembles the earlier Linux threat **ShadowHS**, including use of a *bincrypter*-generated script to decrypt and launch a memory-resident dropper that ultimately executes ClipXDaemon. The malware establishes persistence by appending an execution line (avoiding root privileges, scheduled tasks, or systemd services) and uses **double-fork daemonization** to evade inspection tools. Reported targeting includes multiple wallet formats—at least **Bitcoin, Ethereum, Litecoin, Monero, Tron, Dogecoin** (with additional monitoring noted for **Ripple** and **TON** in one report)—with wallet patterns and replacement data protected via encryption (including **ChaCha20** in the analyzed binary), and the payload was reported as undetected on VirusTotal at the time of analysis.
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026