Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and TorBased C2

Microsoft has disclosed details of a Windowsbased cryptocurrency clipper campaign codenamed CryptoBandits that has targeted users since February 2026 with clipboardintercepting malware with selfspreading capabilities and using the Tor anonymity network to hide communication The clipper in this campaign relies on Windows Script Host and ActiveXdriven logic to launch a bundled Tor proxy and