{"id":13730,"date":"2026-06-19T10:03:37","date_gmt":"2026-06-19T10:03:37","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/06\/19\/hackers-use-weaponized-windows-shortcuts-to-spread-crypto-clipper-across-usb-drives\/"},"modified":"2026-06-19T10:03:37","modified_gmt":"2026-06-19T10:03:37","slug":"hackers-use-weaponized-windows-shortcuts-to-spread-crypto-clipper-across-usb-drives","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/06\/19\/hackers-use-weaponized-windows-shortcuts-to-spread-crypto-clipper-across-usb-drives\/","title":{"rendered":"Hackers Use Weaponized Windows Shortcuts to Spread Crypto Clipper Across USB Drives"},"content":{"rendered":"

Hackers Use Weaponized Windows Shortcuts to Spread Crypto Clipper Across USB Drives
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A newly discovered cryptocurrency clipper malware has been quietly stealing digital assets from victims since February 2026, spreading through a trick that most users would never suspect: weaponized Windows shortcut files on USB drives. <\/p>\n

The malware is not just a simple thief. It comes with worm-like behavior, Tor-based communication, and the ability to execute remote commands, making it one of the more sophisticated financially motivated threats seen this year.<\/p>\n

The attack begins the moment someone plugs in an infected USB drive and clicks on what looks like a familiar document. Unknown to the user, the file is actually a malicious shortcut (.lnk)<\/a> that silently launches harmful payloads in the background. <\/p>\n

The malware hides the original files, replaces them with look-alike shortcuts, and waits for unsuspecting users on other machines to fall into the same trap.<\/p>\n

Analysts from Microsoft Threat Intelligence and Microsoft Defender Experts identified this campaign and noted it has been actively targeting users for several months. <\/p>\n

Microsoft said in a report<\/a> shared with\u00a0Cyber Security News (CSN)\u00a0that the malware carries out high-frequency clipboard theft, screenshot exfiltration, and wallet-address substitution, all while routing its traffic through the Tor network.<\/p>\n

The threat leaves very little trace in the traditional sense. There is no standard installer, no exposed IP address to block, and the core payloads are encrypted and only unpacked at the moment of execution. This preparation suggests the people behind this campaign put significant effort into staying hidden.<\/p>\n

\n
\"High
High level execution flow (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

The financial damage can be immediate and severe. By quietly swapping copied wallet addresses with attacker-controlled ones, it can redirect entire cryptocurrency transactions without the victim noticing until the funds are already gone.<\/p>\n

Hackers Use Weaponized Windows Shortcuts<\/strong><\/h2>\n

The malware\u2019s delivery method is deceptively simple. When a USB drive is inserted into an infected machine, the worm scans it for common file types like .doc, .xlsx, and .pdf. It hides the originals and creates shortcut versions with the same names, trapping the next person who picks up the drive.<\/p>\n

Once a victim clicks one of those shortcuts, the worm drops two malicious JavaScript files into a subfolder under \u201cC:UsersPublicDocuments\u201d using a five-character naming pattern for both the folder and file names. <\/p>\n

It also creates two scheduled tasks to keep the stealer running and the worm spreading to any new USB device connected to the machine.<\/p>\n

The installation is wrapped in multiple layers of obfuscation<\/a>. The initial payload is a Python script protected with PyArmor and packaged into a standalone executable, while the JavaScript files each carry dual-layer obfuscation. <\/p>\n

\n
\"CheckC2Command
CheckC2Command function (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

The malware also terminates itself if Task Manager is detected, making manual inspection significantly harder.<\/p>\n

Tor-Routed Command and Control and Clipboard Theft<\/strong><\/h2>\n

At the heart of this malware is a portable Tor client renamed \u201cugate.exe\u201d that launches in a hidden window. <\/p>\n

Once Tor is running, the malware communicates with its command server<\/a> entirely through .onion addresses, making it nearly impossible to block based on destination domain alone.<\/p>\n

The clipper monitors the clipboard roughly every 500 milliseconds, looking for seed phrases, private keys, and wallet addresses. <\/p>\n

When it spots a copied wallet address, it silently replaces it with one controlled by the attacker. Supported formats include Bitcoin legacy, P2SH, Taproot, Bech32, Tron, and Monero addresses.<\/p>\n

The malware also captures five screenshots in ten-second intervals and sends them back to the attacker over Tor. This gives the operator a fuller picture of what the victim is doing with their funds. <\/p>\n

An EVAL command from the server can also push arbitrary code to run directly on the victim\u2019s machine.<\/p>\n

Defenders are strongly advised to disable AutoRun and AutoPlay for all removable media and to block .lnk execution from USB drives through Group Policy. <\/p>\n

Restricting script interpreters like wscript.exe and cscript.exe where not needed, and hunting for SOCKS5 proxy traffic on localhost:9050, are key steps to catching this threat early. <\/p>\n

Reviewing clipboard and screen-capture behaviors on devices handling financial workflows is equally important.<\/a><\/p>\n

Indicators of Compromise (IoCs):-<\/strong><\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Type<\/th>\nIndicator<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
SHA-256<\/td>\n7630debd35cac6b7d58c4427695579b3e3a8b1cc462f523234cd6c698882a68c<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\na7abf1d9d6686af1cefcd60b17a312e7eb8cfe267def1ec34aeab6128c811630<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\n23c1e673f315dafa14b73034a90dd3d393a984451ff6601b8be8142be6487b43<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\ncf9fc891ea5ca5ecd8113ef3e69f6f52ff538b6cccbdaa9559106fc72bc6da30<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\n100407796028bf3649752d9d2a67a0e4394d752eb8de86daa42920e814f3fae8<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\nd14b80cbd1a19d4ad0473a0661297f8fdf598e81ff6c4ab24e212dcad2e54b3f<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\n9d90f54ae36c6c5435d5b8bed40faf54cc91f6db28574a6310b5ffaeb0362e96<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\n67fc5cf395e28294bbb91ed0e954fdf2e80ebd9119022a115a42c286dc8bacf5<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\n0020d23b0f9c5e6851a7f737af73fd143175ee47054931166369edd93338538a<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\n35a6bc44b176a050fd6824904b7604f0f45b0fdfa26bf9500b9e05973b387cfd<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\nc824630154ac4fdfce94ded01f037c305eab51e9bef3f493c60ff3184a640502<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\nd43bf94f0cb0ab97c88113b7e07d1a4024d1610617b5ad05882b1dbab89e15ba<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\nb2777b73a4c33ac6a409d475057843be6b5d32262ef28a1f1ff5bb52e3834c5f<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\n7787a9a7d8ae393aa32f257d083903c4dc9b97a1e5b0458c4cd480d4f3cb5b05<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\nf3b54984caca95fd496bcfe5d7db1611b08d2f5b7d250b43b430e5d76393f9e0<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
SHA-256<\/td>\n20db98af3037b197c8a846dbf17b87fc6f049c3e0d9a188f9b9a74d3916dd5e1<\/td>\nCrypto Clipper Worm<\/td>\n<\/tr>\n
Filename<\/td>\nugate.exe<\/td>\nPortable Tor binary<\/td>\n<\/tr>\n
Domain<\/td>\ncgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad.onion<\/td>\nC2 domain<\/td>\n<\/tr>\n
Domain<\/td>\ngfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad.onion<\/td>\nC2 domain<\/td>\n<\/tr>\n
Domain<\/td>\nhe5vnov645txpcv57el2theky2elesn24ebvgwfoewlpftksxp4fnxad.onion<\/td>\nC2 domain<\/td>\n<\/tr>\n
Domain<\/td>\nlyhizqy2js2eh6ufngkbzntouiikdek5zsdj3qwa22b4z6knpqorgiad.onion<\/td>\nC2 domain<\/td>\n<\/tr>\n
Domain<\/td>\nj3bv7g27oramhbxxuv6gl3dcyfmf44qnvju3offdyrap7hurfprq74qd.onion<\/td>\nC2 domain<\/td>\n<\/tr>\n
Domain<\/td>\nshinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion<\/td>\nC2 domain<\/td>\n<\/tr>\n
Domain<\/td>\n7goms4byw26kkbaanz5a5u5234gusot7rp5imzc3ozh66wwcvmcudjid.onion<\/td>\nC2 domain<\/td>\n<\/tr>\n
Domain<\/td>\nfacebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion<\/td>\nC2 domain<\/td>\n<\/tr>\n
Domain<\/td>\nwt26llpl5k6gok3vnaxmucwgzv2wk3l7nuibbh25clghrtus3p5ctsid.onion<\/td>\nC2 domain<\/td>\n<\/tr>\n
Domain<\/td>\nijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion<\/td>\nC2 domain<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em>[.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong> Google<\/a><\/strong><\/strong>.<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/p>\n

The post Hackers Use Weaponized Windows Shortcuts to Spread Crypto Clipper Across USB Drives<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Hackers Use Weaponized Windows Shortcuts to Spread Crypto Clipper Across USB Drives A newly discovered cryptocurrency clipper malware has been quietly stealing digital assets from victims since February 2026, spreading through a trick that most users would never suspect: weaponized Windows shortcut files on USB drives. The malware is not just a simple thief. It […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-13730","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13730"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=13730"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13730\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=13730"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=13730"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=13730"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}