Microsoft Uncovers USB-Spreading Worm That Hijacks Crypto Wallets
Microsoft has identified a new strain of malware, which it calls a “crypto clipper”, that has been circulating since February by spreading via infected USB drives to target Windows users’ crypto wallets, according to Microsoft. The company’s Defender Antivirus flags it as Trojan:Win32/CryptoBandits.
How the infection spreads
According to Microsoft’s writeup, the attack begins with a tampered USB drive carrying a malicious shortcut (.lnk) file. Once a user plugs in the drive and opens the shortcut, a worm installs itself on the PC, kicking off two parallel processes: one that runs the wallet-stealing payload continuously, and another that waits for a clean USB drive to be inserted so it can infect that one too.
What the malware actually steals
Once installed through a malicious .lnk shortcut file, the worm monitors the clipboard for seed phrases, private keys and recipient addresses, exfiltrates data over the Tor network, and can silently swap in attacker-controlled wallet addresses. Microsoft’s blog adds further detail: the malware checks the Windows clipboard roughly every half-second, and when it detects a copied seed phrase or private key, it ships that data off to the attacker’s server over Tor, along with a handful of screenshots taken in the seconds after.
Perhaps the more dangerous trick is what happens during an actual transaction, if a user copies a wallet address to send funds, the worm can quietly substitute its own address before the paste happens, redirecting the transfer with no visible warning to the victim.
Self-propagation
The malware propagates by replacing documents on clean USB drives with identically named shortcuts, meaning when an unsuspecting user plugs in a previously clean drive, their everyday files (Word docs, spreadsheets, PDFs) get swapped out for booby-trapped shortcuts bearing the same filenames, continuing the infection chain to the next machine.
Microsoft’s recommendations
Microsoft urged users to disable AutoRun, block .lnk execution on USB media, restrict script hosts and check networks against published indicators of compromise. The company also published file hashes and known .onion command-and-control domains so security teams can scan their networks for signs of compromise.
