Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Hackers Use Tor-Routed C2 and Local SOCKS5 Proxy to Control Crypto Clipper Malware
Excerpt
A sophisticated cryptocurrency clipper malware campaign has been compromising Windows systems since February 2026. Unlike traditional stealers that rely on standard IP-based command-and-control (C2) servers, this malware uses a portable Tor client and a local SOCKS5 proxy. This turns a financially motivated data stealer into a lightweight, remote backdoor capable of bypassing conventional network defenses. The malware is distributed through malicious shortcut (.lnk) files on…
Read the original report →Attack Flow8 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 7630debd35cac6b7d58c4427695579b3e3a8b1cc462f523234cd6c698882a68c | Medium | Score 45/100 | First seen |
| SHA256 | 23c1e673f315dafa14b73034a90dd3d393a984451ff6601b8be8142be6487b43 | Medium | Score 43/100 | First seen |
| SHA256 | a7abf1d9d6686af1cefcd60b17a312e7eb8cfe267def1ec34aeab6128c811630 | Medium | Score 45/100 | First seen |
IOC Relationship Graph
Building graph…