The malware blends data theft with remote code execution, “turning a financially motivated stealer into a lightweight backdoor,” Microsoft said.

Microsoft warns a crypto clipper campaign uses Tor, worm-like spread, and clipboard theft to replace wallet addresses and steal seed phrases.