Microsoft spots new self-propagating malware for stealing cryptocurrency

Microsoft has identified a novel self-replicating malware that infiltrates systems through USB drives, specifically aimed at stealing cryptocurrency credentials. Dubbed Crypto Clipper, this sophisticated worm operates by monitoring clipboard data for signs of wallet addresses or seed phrases. Upon detecting such information, it captures five screenshots over a span of ten seconds, sending both the harvested credentials and images to servers controlled by the attackers. What sets Crypto Clipper apart is its unique method of operation. Unlike traditional malware that relies on standard installation processes or exposed command and control (C2) infrastructure, this worm utilizes a portable Tor client. It cleverly routes its traffic through a local SOCKS5 proxy, effectively masking both the sender and receiver's IP addresses, thereby complicating detection efforts. Microsoft emphasizes the significance of this malware's execution, noting that it seamlessly integrates data theft with remote code execution. This transformation turns what is typically a financially motivated stealing operation into a lightweight backdoor for further exploitation. The company has traced the spread of Crypto Clipper to .lnk files on USB drives, which contain executable code. When an infected USB is connected to a device, the worm checks for its own presence. If absent, it promptly downloads itself via the Tor proxy. To obscure its tracks, the malware meticulously scans the USB drive and names the .lnk files to mimic existing files, further complicating detection and removal efforts.