Microsoft's threat intelligence team stated that an encrypted clipboard trojan campaign targeting Windows users has been active since February 2026. Unlike common malware that only replaces transfer addresses, this wave of attacks also steals sensitive information such as mnemonic phrases and private keys, and attempts to remain on victim devices for an extended period.

Files can be spread via shortcuts.

Microsoft states that these attacks typically begin with malicious .lnk shortcut files. These files can be imported into the system via USB storage devices and launch worm components on Windows devices. Once running, the program uses legitimate files on the device to generate more malicious shortcuts, expanding its reach.

Researchers say the malware also creates scheduled tasks to continue running after the device restarts. This means attackers can monitor compromised devices for longer periods. Because it relies more on scripting tools than on large installation packages, traditional file-based detection methods are less effective at detecting it in a timely manner.

Hidden communication using Tor

Microsoft stated that this Trojan deploys a portable Tor client and forwards traffic through a local SOCKS5 proxy. Its communication uses localhost:9050 and the .onion control domain, thus reducing the visibility of regular DNS traffic and increasing the difficulty of interception.

During operation, the malware checks the clipboard approximately every 500 milliseconds, focusing on wallet addresses, mnemonic phrases, and private keys. Once a wallet address is identified, the program can replace it with an address controlled by the attacker; if a mnemonic phrase or private key is found, it may be sent back directly via the Tor channel.

It's no longer just address replacement.

Microsoft stated that the risk of this campaign lies in its functionality going beyond traditional clipboard hijacking. In addition to replacing addresses, the malware can also upload screenshots, connect to hidden command and control servers, and execute attacker-sent code via a command called EVAL.

This means it's no longer just a single-purpose data theft tool, but more like a lightweight backdoor. Once a device is infected, the attacker's privileges and the time they can remain on the device can increase, and the victim faces more than just the risk of a single transaction being tampered with.

Additional information:Microsoft has labeled this threat as Trojan:Win32/CryptoBandits.A. The report also mentions that similar malware has previously appeared, monitoring browser wallets and scanning screenshots for mnemonic phrases, indicating that attacks targeting encrypted users are continuously escalating.