TLDR Tech / InfoSec
Microsoft discovers new lightweight backdoor that steals cryptocurrency
Crypto Clipper is a worm that spreads via USB using .lnk files and a bundled Tor client to route traffic through a local SOCKS5 proxy. It monitors clipboards for wallet addresses and 12- or 24-word seed phrases, exfiltrates them with screenshots over Tor, and swaps copied crypto addresses for attacker-controlled ones. Defender products flag it through suspicious script interpreters, localhost:9050 proxy use, screen-capture commands, and clipboard or address-replacement behavior.
Read the full story