Crypto Clipper is a trojan deployed via USB storage devices that has been affecting users since February 2026. It looks for clipboard data and other valuable assets, predominately associated with Crypto wallet addresses, and exfiltrates this information with Clipper malware.
It does this through a bundled Tor proxy, using Windows Script host and ActiveX logic, to connect to a hidden C2 server, carrying out high frequency clipboard theft, collecting screenshots, and running crypto wallet address
