Microsoft warns USB malware hijacks crypto wallets

TLDR

Microsoft is warning that a new Windows malware campaign spread by USB drives is actively targeting crypto wallets and seed phrases.

1. The malware, dubbed CryptoBandits, spreads via infected USB sticks and swaps copied wallet addresses with attacker addresses.
2. It also hunts for seed phrases and private keys, acting as a backdoor that can fully take over your wallets and even your PC.
3. The main defenses are strict USB hygiene, always verifying destination addresses, and keeping keys off your everyday Windows machine.

Deep Dive

1. How The USB Malware Works

Microsoft describes a campaign detected as Trojan:Win32/CryptoBandits, a "crypto clipper" that has been active since at least February 2026 on Windows systems. Reports from several outlets summarize the same technical details from Microsofts threat write up, including CoinDesk and Cointelegraph.

Infection starts when you plug in an infected USB drive and open a malicious shortcut (.lnk) that looks like a normal document. The malware then hides real files and replaces them with lookalike shortcuts, so it can spread to more USBs. Once running, it monitors the clipboard several times per second, looking for wallet addresses, seed phrases and keys, and silently swaps any copied destination address for one controlled by the attacker.

It also uses a bundled Tor client to talk to hidden command servers, which makes it harder for defenders to trace or block.

2. Why This Is Dangerous For Crypto Users

This is not just an info stealer that grabs browser passwords. Microsoft says the clipper targets "high value financial artifacts" such as BIP39 seed phrases and Bitcoin or Ethereum private keys, which means a total takeover of affected wallets is possible.

Because the malware runs on your PC, it can affect any software wallet, browser extension wallet, or exchange session that depends on copy and paste and on-screen confirmation. Some analyses note it also executes attacker supplied code remotely, turning a simple theft tool into a lightweight backdoor that could be used later for ransomware or broader account compromise.

3. Defenses, Habits, And Red Flags

Microsofts guidance and independent write ups converge on a few practical points.

1. Treat unknown USB drives as hostile, and avoid opening shortcut files that appear in place of normal documents.
2. On Windows, disable AutoRun and restrict .lnk execution from USB media where possible, and keep security tools updated.
3. When sending crypto, do not rely on blind copy and paste. Check at least the first and last characters of the address on a trusted screen, especially for larger transfers or withdrawals.

For seed phrases and keys, the safest pattern is to avoid storing them in text files on general purpose Windows machines and to use dedicated hardware wallets or offline storage for long term holdings.

Conclusion

Microsofts warning highlights that physical devices like USB sticks remain a serious threat vector for crypto, especially when malware can silently hijack clipboard data and addresses. If you keep significant assets in software wallets or interact with exchanges from a Windows machine, the biggest risk reduction comes from treating removable media with suspicion, verifying every destination address, and keeping your most important keys off the computer that touches the internet every day.