tor c2

The tor c2 tag covers reporting on malware campaigns that use Tor as an anonymized command-and-control or proxy channel. Current coverage focuses on a Windows cryptocurrency clipper that spreads through malicious USB shortcut files, launches a bundled Tor SOCKS proxy, and uses script-based components to steal wallet data. The report also highlights related attack surfaces, including Windows Script Host, scheduled tasks, removable media, and localhost proxy traffic. This tag is relevant to readers following Windows malware, cryptocurrency theft, threat intelligence, and defensive investigation of suspicious Tor activity linked to infections.