Microsoft flags Tor-based crypto clipper hitting Windows users
The threat spreads offline via USB and .lnk shortcuts, then runs bundled Tor to reach a hidden-service C2 — clipboard swap plus seed-phrase theft is the actual loss vector, not just an address swap.
WuBlockchain