Microsoft announces new type of crypto trojan threat: can spread covertly via Tor and hijack wallet addresses

Odaily reported that Microsoft's threat intelligence team officially disclosed a Windows crypto malware threat that has been active since February 2026. This malicious software combines "worm-like propagation + clipboard hijacking + Tor anonymous communication" to launch attacks targeting digital asset users.

Microsoft's analysis indicates that the malicious program spreads via disguised shortcut (.lnk) files across removable storage devices, leveraging WScript and ActiveX to execute script logic. It automatically deploys a local Tor client, connecting through 127.0.0.1:9050 as a proxy. The onion hidden service C2 server enables anonymous control and data transfer. The attack chain includes multiple malicious capabilities: ongoing clipboard content monitoring, theft of mnemonics and private keys, screenshot uploads, and "address replacement" when users copy cryptocurrency addresses, substituting the target address with a wallet address controlled by the attacker to hijack funds.

Additionally, the trojan possesses worm propagation abilities, automatically replicating itself onto devices such as USB drives, creating scheduled tasks for persistent operation, and basic anti-analysis features (detecting Task Manager to evade debugging).

On the detection side, Microsoft has identified it as part of the Trojan:Win32/CryptoBandits series, intercepting it using behavioral characteristics such as abnormal WScript calls, localhost:9050 proxy traffic, and PowerShell screenshot behavior. Security researchers recommend focusing on protecting script execution paths and monitoring abnormal local proxy traffic.