Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2

Microsoft Threat Intelligence reports an active Windows-targeting clipboard-hijacking (clipper) campaign that replaces copied cryptocurrency wallet addresses to redirect funds to attacker-controlled wallets. The campaign includes a self-spreading USB LNK worm component, Tor-routed C2, multi-currency address targeting, persistence via scheduled tasks and registry run keys, and has resulted in cross-regional financial losses; Microsoft published detection guidance and IOCs (file hashes, scheduled task names, Tor hidden service addresses) for defenders.