Microsoft announces that a new cryptographic Trojan threat can be hidden and spread through Tor and hijack wallet addresses

Microsoft's Threat Intelligence Team officially announced a Windows encryption Trojan threat that has been active since February 2026. The malware combines "worm spread + clipboard hijacking +Tor anonymous communication" to attack users of digital assets. Microsoft analysis pointed out that the malicious program spread between removable storage devices through disguised shortcut (.lnk) files, and used WScript and ActiveX to execute script logic, automatically deployed local Tor clients, and connected through a 127.0.1:9050 proxy. Onion hides the service C2 server to implement anonymity control and data transmission. The attack chain includes multiple malicious capabilities: continuously monitoring clipboard content, stealing mnemonics and private keys, uploading screenshots, and "address replacement" when users copy cryptocurrency addresses, replacing the target address with a wallet address controlled by the attacker., thereby achieving fund hijacking. In addition, the Trojan also has worm propagation capabilities, can automatically copy itself in devices such as USB flash drives, and create planned tasks for persistent operation. It also has basic anti-analysis capabilities (detects task managers to avoid debugging). At the detection level, Microsoft has identified it as the Trojan:Win32/CryptoBandits series and intercepted it through behavioral characteristics such as abnormal WScript calls, localhost:9050 proxy traffic, and PowerShell screenshot behavior. Security researchers suggest focusing on protecting script execution paths and local agent abnormal traffic monitoring.