Tor-Based Clipper Malware Targets Wallet Seed Phrases

Microsoft-tracked Tor-based clipper campaign uses malicious .lnk USB shortcuts to deploy a Python-based clipboard stealer that captures BIP39 seed phrases, private keys, and wallet addresses, replaces copied addresses with attacker-controlled ones, takes frequent screenshots, and exfiltrates data via a bundled Tor client to .onion C2s; the malware supports remote JavaScript execution, employs runtime decryption and obfuscation, is detected as Trojan:Win32/CryptoBandits.A, and defenders are advised to monitor wscript/cscript activity, localhost:9050 proxy use, and block .lnk execution from removable drives.