OAK — OnChain Attack Knowledge

Worked example · 2026-06

CryptoBandits — USB-worm crypto-clipper with Tor C2 and clipboard secret-harvesting — Windows / cross-chain — disclosed 2026-06-17

Loss
undisclosed. Microsoft did not publish a victim count or an aggregate theft figure. The malware has been active since February 2026 and was disclosed on 2026-06-17 by the Microsoft Defender Security Research Team and Microsoft Defender Experts, who detect it as Trojan:Win32/CryptoBandits.A (with .B Win32 and JScript variants) and, in the removable-media propagation form, Trojan:Win32/ClipBanker.USB!MTB (security-intelligence update 1.391.1092.0, 2026-06-17). Because the extraction primitive is per-victim clipboard substitution plus seed/key exfiltration rather than a single on-chain drain, the realised loss is distributed across an unknown number of infected endpoints and is not centrally tabulated.
OAK Techniques observed
OAK-T4.012 (Clipboard-Hijacker / Clipper Address Substitution — primary; a resident clipboard monitor polls roughly every 500 ms, detects copied cryptocurrency addresses and silently replaces them with attacker-controlled addresses, and additionally harvests BIP39 seed phrases (12–24 words) and private keys (Ethereum hex / Bitcoin WIF) from the clipboard plus periodic screenshots for context. See techniques/T4.012-clipboard-hijacker-clipper-address-substitution.md). OAK-T4.012.001 (removable-media / worm-propagated clipper sub-shape — the load-bearing delivery shape: malicious .lnk shortcut payloads on USB drives auto-execute when Windows Explorer renders the drive, and the worm component creates additional malicious shortcuts of legitimate files it finds and re-propagates onto newly inserted removable drives via scheduled tasks; forward candidate tracked in TAXONOMY-GAPS).
Attribution
unattributed. Microsoft assigned no named threat actor or cluster. The operation is anonymised end-to-end: C2 runs through a bundled Tor client (ugate.exe) via a local SOCKS5 proxy on localhost:9050, with command/exfiltration over HTTP POST to .onion hidden services, and the published indicators are ten worm-component SHA-256 hashes plus ten .onion C2 domains rather than any operator identity.
Key teaching point
A clipper is a host-side recipient-substitution attack that lives entirely upstream of the wallet and the chain — the only durable defences are at the endpoint and in full-address verification at sign time. CryptoBandits is a clean 2026 anchor for OAK-T4.012 because it pairs the canonical clipper primitive (≈500 ms clipboard polling → same-coin address swap) with a secret-harvesting arm (BIP39 + WIF/hex key exfiltration, screenshots) over the same clipboard-monitoring surface, so a single infection escalates from "wrong recipient on this transfer" to "every wallet whose seed or key ever touched this clipboard is compromised." None of it produces an on-chain authorisation event: there is no approval, no permit, no malicious signature to catch — the victim authorises a normal-looking send to a pasted address. The actionable lessons are therefore endpoint-side and wallet-UX-side: disable AutoRun/AutoPlay and block .lnk execution from removable drives (defeats the worm vector), monitor for localhost:9050 / non-browser Tor egress and script-to-network chains (defeats the covert C2), and — the highest-leverage user control — verify the full destination address with checksum at sign time, never the truncated first/last few characters, because the substitute address is chosen to survive a truncated glance. Any seed phrase or key that touched an infected host must be treated as burned and migrated to fresh keys on a clean device.

Summary

CryptoBandits is a Windows crypto-clipper that Microsoft's Defender research teams disclosed on 2026-06-17 after tracking activity since February 2026. It comprises two components: a worm that ensures propagation, and a clipper/stealer that harvests and exfiltrates cryptocurrency wallet material. The clipper relies on Windows Script Host and ActiveX-driven JScript logic to launch a bundled Tor proxy and poll a hidden-service C2; it performs high-frequency clipboard theft (~500 ms), wallet-address substitution, seed-phrase and private-key harvesting, and screenshot exfiltration (reported as five captures ten seconds apart for context). The clipboard monitor matches popular address formats (Bitcoin, Ethereum, Litecoin, and others) and replaces a copied address with an attacker-controlled one, frequently preserving partial character matches so the substitution survives a casual visual check.

Propagation is worm-like via removable media: specially crafted .lnk files that Windows Explorer processes automatically when a USB drive is inserted execute the payload (icon rendering alone is sufficient to trigger it), and the worm creates additional malicious shortcuts of legitimate files and re-seeds them onto newly inserted drives, with scheduled tasks providing persistence and re-propagation. C2 and exfiltration are routed through a bundled Tor client (ugate.exe) over a SOCKS5 proxy at localhost:9050, communicating via HTTP POST to .onion domains. The malware also exposes an EVAL command that executes arbitrary JScript delivered from the C2 server — i.e. remote code execution on the infected host. Microsoft published ten worm-component SHA-256 hashes, the ugate.exe Tor-binary filename, and ten .onion C2 domains as indicators, and recommended disabling AutoRun/AutoPlay, blocking .lnk execution from removable drives via GPO, monitoring localhost:9050 activity, and hunting script-to-network execution chains (e.g. curl/PowerShell).

Timeline (UTC)

When Event OAK ref
2026-02 CryptoBandits activity begins; .lnk-based USB worm seeds infections; clipper/stealer harvests clipboard addresses, seed phrases, and private keys and exfiltrates over Tor T4.012 + T4.012.001
2026-02 → 2026-06 Standing campaign: ~500 ms clipboard polling, same-coin address substitution, screenshot capture, Tor .onion C2, EVAL remote code execution; worm re-propagates via scheduled tasks on inserted removable media T4.012 (clipper + secret-harvest arms)
2026-06-17 Microsoft Defender Security Research Team + Defender Experts disclose the family; Defender detects Trojan:Win32/CryptoBandits.A/.B and Trojan:Win32/ClipBanker.USB!MTB (intel update 1.391.1092.0); IOCs published (10 worm hashes, ugate.exe, 10 .onion domains) (defender-side disclosure)

Public references

Discussion

CryptoBandits is the removable-media worm-propagated anchor (T4.012.001) for OAK's new clipper technique. It is worth contrasting carefully with OAK-T4.003 (Address Poisoning): both attacks end with the victim sending funds to an attacker address they believed was correct, and both are ultimately defeated by the same user habit — verifying the full destination address rather than a truncated prefix. But the mechanism and the defender's instrumentation point are different. T4.003 plants look-alike transactions in the victim's on-chain wallet history and waits for the victim to copy-paste from that history; there is no malware on the host, and the manipulated substrate is the wallet UI. CryptoBandits manipulates the clipboard on the endpoint in real time, so it works regardless of where the victim copied the address from, and it is invisible to on-chain detection because no authority is ever granted on-chain — the only signals are at the endpoint (clipboard-behaviour, Tor egress, .lnk-on-USB, scheduled tasks) and at the wallet-UX layer (full-address verification at sign time). See techniques/T4.003-address-poisoning.md for the on-chain sibling.

The case also illustrates why OAK classifies the clipboard substitution / secret-harvesting primitive as the crypto-relevant technique and treats the surrounding capabilities — USB-worm propagation, Tor-anonymised C2, scheduled-task persistence, EVAL remote code execution — as general-malware delivery/operational context rather than minting each as a separate crypto-attack technique. That scoping keeps the taxonomy focused on the value-extraction mechanism (recipient substitution and key exfiltration) while still recording the operational facets that make a given clipper campaign more or less dangerous. CryptoBandits sits alongside the same week's reputation-laundered Rust clipper (T4.012.002, see examples/2026-06-rust-clipper-fake-reputation-ghost-network.md) as the two independent 2026 anchors that justify promoting the clipper class from a long-standing taxonomy gap into a first-class technique.

Techniques demonstrated (2)