Microsoft announces new type of crypto trojan threat: can spread covertly via Tor and hijack wallet addresses
Odaily reported that Microsoft's threat intelligence team officially disclosed a Windows crypto malware threat that has been active since February 2026. This malicious software combines "worm-like propagation + clipboard hijacking + Tor anonymous communication" to launch attacks targeting digital asset users.
Microsoft's analysis indicates that the malicious program spreads via disguised shortcut (.lnk) files across removable storage devices, leveraging WScript and ActiveX to execute script logic. It automatically deploys a local Tor client, connecting through 127.0.0.1:9050 as a proxy. The onion hidden service C2 server enables anonymous control and data transfer. The attack chain includes multiple malicious capabilities: ongoing clipboard content monitoring, theft of mnemonics and private keys, screenshot uploads, and "address replacement" when users copy cryptocurrency addresses, substituting the target address with a wallet address controlled by the attacker to hijack funds.
Additionally, the trojan possesses worm propagation abilities, automatically replicating itself onto devices such as USB drives, creating scheduled tasks for persistent operation, and basic anti-analysis features (detecting Task Manager to evade debugging).
On the detection side, Microsoft has identified it as part of the Trojan:Win32/CryptoBandits series, intercepting it using behavioral characteristics such as abnormal WScript calls, localhost:9050 proxy traffic, and PowerShell screenshot behavior. Security researchers recommend focusing on protecting script execution paths and monitoring abnormal local proxy traffic.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
BRIEF-Lamb Weston Holdings Announces Quarterly Dividend
Lamb Weston Holdings, Inc. LW.N: LAMB WESTON HOLDINGS ANNOUNCES QUARTERLY DIVIDEND LAMB WESTON HOLDINGS - DECLARES QTRLY DIVIDEND OF $0.38 PER SHARE Source text: ID:nBwWVH9na Further company coverage: LW.N
XRP Ledger Prints 386% Comeback in Important Metric
BUZZ—US Stock Market Updates—MYR Group, Spyre Therapeutics, AMD
Search string for querying individual stock trends: STXBZ "Today's Outlook" newsletter: https://refini.tv/3LI4BU7 "Morning News Briefing": https://refini.tv/3dKUyB8 Reuters, October 6 - U.S. stock index futures rose on Tuesday as Treasury yields retreated from multi-year highs and oil prices declined, providing a bit of relief for investors ahead of the quarterly earnings season. ** MYR Group MYRG.O: Market Spotlight — Jefferies upgraded MYR Group to "Buy"; stock price rose nL4N45S0PK ** Spyre Therapeutics SYRE.O: Market Action — Spyre Therapeutics shares fell due to a $350 millions stock offering nL6N45S0PG ** AMD.O: Market Action — AMD shares rose on plans to increase chip supply nL4N45S0Q7 ** Constellation Energy CEG.O: Highlight — Alphabet reportedly close to signing a multi-year nuclear energy deal, Constellation Energy shares climbed nL6N45S0HX ** Nike NKE.N: Highlight — Berenberg downgraded Nike to "Sell"; shares declined nL6N45S0KB ** Option Care Health OPCH.O: Highlight — Option Care Health surged after reportedly receiving a buyout offer exceeding $5 billions nL4N45S0L5 ** Freshworks Inc FRSH.O: Market Action — Freshworks stock advanced as it is set to be added to the S&P SmallCap 600 nL4N45S0IT (For the convenience of non-English speakers, Reuters automatically translates its reports into various other languages. As automatic translation may be inaccurate or lack necessary context, Reuters does not guarantee the accuracy of automated translations and provides them solely for readers' convenience. Reuters is not responsible for any damage or loss caused by the use of automatic translation features.)
Top Premarket Decliners
07:38 AM EDT, 10/06/2026 (MT Newswires) -- Armada Acquisition Corp. II (XRPN) shares were down more than 16% in premarket activity Tuesday following a nearly 2% fall in the prior session. HeartSciences (HSCS) stock was 14% lower after a 1.4% gain in the prior session. WISeSat.Space (SAIQ) shares were down 13% after a 260% rise at the previous close. CTW (CTW) stock was 7% lower after remaining flat at Monday's close. Republic Power Group (RPGL) shares were down 4% after a regulatory filing showed that the company and its institutional investor mutually agreed to terminate an additional investment right, with Republic paying a $250,000 termination fee.
Crypto prices
More
