Microsoft Warns Crypto Users About Windows Clipper Malware Campaign

Microsoft Threat Intelligence has uncovered a sophisticated Windows malware campaign dubbed Trojan:Win32/CryptoBandits.A, targeting cryptocurrency users through clipboard manipulation. The clipper malware spreads via removable drives, replacing documents with malicious shortcuts while actively monitoring copied wallet addresses.

The attack vector exploits a common crypto user behavior—copying and pasting wallet addresses. By swapping legitimate addresses with attacker-controlled ones during transactions, victims unknowingly send funds to malicious parties. Blockchain's irreversible nature compounds the damage, with losses often realized only after transaction confirmation.

Microsoft's report highlights the malware's aggressive clipboard monitoring frequency and additional capabilities to identify sensitive cryptocurrency-related data. This development underscores the evolving threat landscape beyond exchange hacks and smart contract vulnerabilities.