CryptoBandits Malware Uses Tor for C2 and Acts as a Backdoor
Summary
Microsoft reports that the Windows-based CryptoBandits malware steals cryptocurrency wallet data, substitutes clipboard addresses, and uses a bundled Tor client for command-and-control and remote tasking.
Key points
- Microsoft says CryptoBandits has been used in attacks since February 2026 and is distributed through malicious Windows shortcut files.
- The malware deploys a propagation worm and a clipper/stealer; the worm scans connected USB devices and creates malicious shortcuts of legitimate files.
- The script-based clipper uses Windows Script Host and ActiveX, checks for Task Manager, and establishes persistence through scheduled tasks.
- It steals wallet seed phrases and private keys, takes screenshots, and can replace copied cryptocurrency addresses with attacker-controlled ones.
- A renamed Tor client routes command-and-control through a local SOCKS5 proxy; the malware polls for instructions every 500 milliseconds.
- Microsoft describes runtime decryption and obfuscation across the installer and JavaScript payloads, and recommends monitoring script activity, local SOCKS proxy use, and related network, clipboard, and process behavior.
Article Details
- Attack Vectors
- CryptoBandits is distributed through malicious Windows shortcut (.lnk) payloads.
- The malware scans connected USB devices and creates malicious shortcuts for legitimate files to propagate.
- Its script-based components use Windows Script Host and ActiveX; JavaScript payloads are also deployed.
- The malware uses a bundled Tor client and a local SOCKS5 proxy for command-and-control communications, polling for instructions every 500 milliseconds.
- CryptoBandits steals cryptocurrency wallet information, including seed phrases and private keys, and substitutes attacker-provided wallet addresses in the clipboard.
- The malware captures screenshots and exfiltrates clipboard data.
- It establishes persistence through scheduled tasks and can deliver file-based payloads excluded from Defender scanning.
- Defensive Notes
- Harden script execution paths.
- Monitor for abuse of local SOCKS proxies.
- Use behavioral hunting to correlate script activity with network, clipboard, and process signals.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article reports multi-layered obfuscation of the malware components and its installer and JavaScript payloads.T1053.005 · Scheduled TaskCryptoBandits establishes persistence through scheduled tasks.T1057 · Process DiscoveryThe malware checks whether Task Manager is running as an anti-analysis measure.T1059.007 · JavaScriptThe malware uses JavaScript payloads alongside Windows Script Host and ActiveX-driven script logic.T1090.003 · Multi-hop ProxyA bundled Tor client routes command-and-control traffic through Tor, using a local SOCKS5 proxy.T1091 · Replication Through Removable MediaCryptoBandits scans connected USB devices and creates malicious shortcuts on them to propagate.T1113 · Screen CaptureThe malware captures screenshots for exfiltration.T1115 · Clipboard DataThe malware steals clipboard contents and replaces cryptocurrency addresses with attacker-provided addresses.T1140 · Deobfuscate/Decode Files or InformationCryptoBandits decrypts its components at runtime.T1562.001 · Disable or Modify ToolsIt can deliver file-based payloads that it excludes from Defender scanning.