NewApp Digest
search bot

clipboard

Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2
Winsage
June 19, 2026

Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2

Microsoft has identified a Windows-based cryptocurrency clipper campaign that has been active since February 2026. This campaign uses clipboard-intercepting malware with self-spreading capabilities and operates through the Tor network. The clipper malware employs Windows Script Host and ActiveX to launch a Tor proxy and connect to a hidden command-and-control server. It focuses on stealing clipboard data, particularly cryptocurrency wallet addresses, and can exfiltrate screenshots. The malware is distributed via malicious Windows Shortcut (LNK) files on USB drives, which activate a worm that checks for existing infections and fetches the payload from a remote server. The clipper monitors the clipboard every 500 milliseconds for sensitive information and can replace copied wallet addresses with those controlled by attackers. Microsoft recommends behavioral detections, disabling AutoRun for removable media, blocking LNK execution from drives, and monitoring clipboard-related activities as mitigations against this threat.
Windows SprySOCKS Malware: Advanced Kernel-Level Rootkit Targets Government Organizations via Supply Chain Vulnerabilities
Winsage
June 17, 2026

Windows SprySOCKS Malware: Advanced Kernel-Level Rootkit Targets Government Organizations via Supply Chain Vulnerabilities

The Windows variant of SprySOCKS malware, developed by the Chinese threat group Earth Lusca, targets government entities globally and features advanced capabilities such as rootkit-level stealth and extensive command-and-control (C2) functionalities. It operates on Windows systems, utilizing two main variants: WINDRV, which includes kernel drivers for stealth operations, and WINPLUS, a streamlined backdoor. The malware can communicate over TCP, UDP, and WebSocket, offering over 30 C2 commands for various operations, including system information gathering and keystroke logging. WINDRV loads a driver named ‘RawWNPF’ into memory using another signed kernel driver, allowing it to conceal processes and achieve persistence. The malware's design incorporates open-source elements and exploits vulnerabilities in the software supply chain, notably using a leaked certificate for driver signing. To combat SprySOCKS, organizations are advised to implement advanced endpoint detection and response (EDR) solutions, maintain regular patching, and manage supply chain risks vigilantly. The malware's adaptability and reliance on legitimate certificates complicate detection efforts, necessitating continuous refinement of security practices.
For June, Patch Tuesday means an IT scramble
Winsage
June 13, 2026

For June, Patch Tuesday means an IT scramble

A systematic approach to testing is essential following the latest updates. The process begins with installing the .NET SDK update, then building and executing representative applications to ensure existing projects compile and run without issues. For SQL Server users, the GDR update must be installed on the appropriate branch, followed by a service restart and standard transaction execution to verify stability. Backup and restore verification is also necessary, including checking the health of Always On availability groups and testing patch installation and removal. The Readiness team recommends prioritizing testing for Remote Desktop this month due to its frequent patches and high-risk classification. The focus should be on printer redirection, followed by general connectivity, RemoteApp functionality, clipboard and device redirection, gateway access, and licensing considerations. The next priority is validating NTLM authentication updates, including domain and standalone logon processes, file-share access, and application sign-in capabilities. Other updates are security-focused with no functional changes, requiring routine regression testing across networking, Hyper-V, storage, and graphics components. Office remains MSI-only, with Click-to-Run installations unaffected by these updates. The updates for .NET and SQL Server complete the landscape for developers and database administrators.
Search