Microsoft's Threat Intelligence team has disclosed a sophisticated Windows clipboard trojan that has been active since February 2026. This malware employs a combination of worm-like propagation, clipboard hijacking, and Tor anonymous communication to specifically target digital asset users.

The threat operates by stealthily spreading across systems and intercepting wallet addresses copied to the clipboard, replacing them with attacker-controlled addresses to facilitate theft. This evolution in malware tactics highlights the increasing sophistication of threats targeting cryptocurrency holders.