Microsoft warns USB malware targets crypto wallets

TLDR

Microsoft has disclosed a new Windows malware campaign that spreads via USB drives and is designed specifically to steal cryptocurrency.

1. Microsoft describes a USB-spreading crypto clipper worm, dubbed Trojan:Win32/CryptoBandits, that hijacks clipboard data and silently swaps crypto wallet addresses.
2. The malware also hunts for seed phrases and private keys, exfiltrating them over Tor and leaving a backdoor that can be used for broader attacks, including ransomware.
3. Crypto users can significantly cut risk by treating all USB drives as untrusted, double checking addresses before sending, and keeping wallet secrets off infected or shared machines.

Deep Dive

1. What Microsoft Found

Microsoft Threat Intelligence reports a malware family detected as Trojan:Win32/CryptoBandits that has been active since at least February 2026 and targets Windows users handling crypto.

It spreads through malicious Windows shortcut (.lnk) files on infected USB drives which hide real documents and replace them with identically named shortcuts that launch the malware when opened.

Once installed, the worm monitors the clipboard roughly every 500 milliseconds and, when it sees a crypto address, replaces it with an attacker controlled address, redirecting funds during copy paste operations. CoinDesks summary and Cointelegraphs write up both describe this behavior.

2. Why It Is Dangerous For Wallets

Microsoft says the malware goes beyond address swapping: it scans the clipboard for 12 and 24 word seed phrases, private keys and other wallet credentials, then sends them over Tor to attacker servers.

It also captures screenshots and maintains remote access, effectively turning infected PCs into lightweight backdoors that can later be used for further theft or even ransomware deployment.

Because it targets generic wallet data, the risk applies across many chains and wallet types, especially software wallets and any situation where a seed phrase is ever copied on a Windows machine.

3. Practical Ways To Reduce Risk

Microsoft recommends defensive steps such as disabling AutoRun/autoplay for removable media and blocking execution of .lnk files from USB drives, especially on corporate or shared machines.

For individual crypto users, safer patterns include: treating unknown USB sticks as hostile, avoiding copying seed phrases or private keys on internet connected PCs, and carefully checking full destination addresses before confirming sends.

Keeping Windows and security tools updated, and ensuring Defender or another antivirus is detecting CryptoBandits variants, reduces the window in which this specific campaign can succeed.

Conclusion

Microsofts alert highlights that some of the most effective crypto attacks now target users everyday workflows, not blockchains themselves.

By understanding how USB based clippers like CryptoBandits operate and adjusting basic security habits around devices, clipboards and seed handling, crypto users can stay a step ahead of this class of threat.