Microsoft Threat Intelligence has warned of a Windows-based crypto clipper campaign that has affected users since February 2026.
Summary
- Microsoft says CryptoBandits uses Tor-routed communication, wallet replacement, screenshots, and remote code execution on Windows.
- The malware spreads through malicious shortcut files and creates more infected shortcuts from legitimate files.
- Security teams should hunt linked behaviors, not isolated alerts, to catch this attack chain early.
In a Microsoft blog, researchers said the malware steals clipboard data, replaces wallet addresses, and searches for valuable crypto information.
The company said Microsoft Defender…
