Microsoft Uncovers USB-Spreading Malware Targeting Crypto Wallets, Stealing Keys via Clipboard Monitoring

Microsoft has identified a sophisticated malware campaign targeting cryptocurrency holders on Windows systems, with the threat actor using infected USB drives as its primary propagation method since February, according to a company blog post published this week.

The malware, detected by Microsoft Defender Antivirus as Trojan:Win32/CryptoBandits, operates as what the firm describes as a "crypto clipper" — intercepting sensitive credential data from users' clipboards and manipulating transaction details in real time. The threat represents a significant escalation in crypto-specific attack vectors, combining clipboard monitoring with silent address replacement to redirect funds without any visible indication to victims.

Market Context

The discovery arrives amid ongoing concerns about security vulnerabilities in cryptocurrency self-custody. Hardware wallet manufacturers have emphasized air-gapped storage and transaction verification processes as defenses against such threats. Security researchers note that the USB-based propagation method bypasses network-level protections, making traditional perimeter security ineffective against attacks originating from physical media.

Analysis

The malware's infection chain begins when a user plugs in an infected USB drive containing a malicious .lnk shortcut file. Upon clicking the shortcut, the worm installs onto the host system and immediately begins two concurrent operations: running the credential-harvesting component and scanning for clean USB drives to infect.

Once established, the malware monitors Windows' clipboard approximately every 500 milliseconds, capturing cryptocurrency seed phrases, private keys, and recipient wallet addresses as users copy them. The stolen data is exfiltrated to attacker-controlled command-and-control servers over the Tor network, with the malware also taking five screenshots at ten-second intervals to capture additional context around each theft attempt.

Perhaps most concerning is the worm's address substitution capability. When a user copies a legitimate recipient address to initiate a transfer, Trojan:Win32/CryptoBandits silently replaces it with an attacker-controlled wallet address before the user pastes — meaning funds are redirected without any visual discrepancy in the transaction details.

The propagation mechanism compounds the threat's reach. When a clean USB drive is inserted into an infected system, the worm scans for ordinary files including Word documents, Excel spreadsheets, and PDFs, replacing them with identically named malicious shortcut files that replicate the infection cycle on new host machines.

Security researchers tracking the campaign note that the use of .lnk file exploitation combined with physical media propagation represents a return to techniques more commonly associated with state-sponsored threat actors rather than typical cybercrime operations. The Tor-based exfiltration infrastructure suggests organized criminal involvement, while the targeted nature of cryptocurrency theft indicates financial motivation over espionage objectives.

Key Numbers

- Malware monitoring interval: clipboard checked approximately every 500 milliseconds

- Screenshots captured per theft attempt: five images taken ten seconds apart

- Exfiltration method: data sent over Tor network to attacker-controlled servers

- Infection vector: malicious .lnk shortcut files on USB removable media

- Command-and-control infrastructure: .onion domains published in Microsoft's indicators of compromise

What to Watch

Microsoft has published a comprehensive list of indicators of compromise including file hashes and command-and-control domain signatures for security teams to audit their networks. Organizations should immediately disable AutoRun functionality for removable media, implement group policy restrictions blocking .lnk file execution from USB drives, and consider restricting script hosts such as wscript.exe and cscript.exe. Microsoft Defender customers can run hunting queries to detect connections to local Tor proxy on port 9050.

Security practitioners emphasize that users who have plugged unknown USB drives into systems containing cryptocurrency wallet software should treat seed phrases and private keys as compromised, initiating key rotation procedures immediately. Hardware wallet users are advised to verify all transaction addresses character-by-character on device screens rather than relying on clipboard-derived data during the confirmation process.