Microsoft uncovers USB malware stealing crypto wallets

TLDR

Microsoft has identified a new Windows malware campaign, CryptoBandits, that spreads via USB sticks and can hijack crypto transactions and steal wallet secrets from the clipboard.

1. CryptoBandits is a USB-spreading crypto clipper that hides on shortcut files and swaps copied wallet addresses with attacker-controlled ones.
2. It also hunts for seed phrases and private keys, exfiltrates data over Tor, and functions as a lightweight backdoor on infected machines.
3. You can cut risk significantly by treating USBs as untrusted, locking down .lnk/scripts, and verifying wallet details before every transaction.

Deep Dive

1. How CryptoBandits Works

Microsoft Threat Intelligence reports a Windows malware strain detected as Trojan:Win32/CryptoBandits that has been active since February and spreads via infected USB drives containing malicious `.lnk` shortcut files. When a user opens what looks like a normal document shortcut, a worm installs, then replaces real documents on the USB with identically named infected shortcuts, allowing it to spread to more machines and drives as they are plugged in.

Once running, the malware continuously monitors the clipboard roughly every 500 milliseconds for crypto wallet addresses, seed phrases, and private keys, then silently swaps any copied address with one controlled by the attacker so outgoing transfers are redirected without obvious visual change. Reports note it targets multiple ecosystems, including Bitcoin and Ethereum, and is specifically optimized to abuse copy paste behavior for crypto transfers.

2. Why This Threat Matters

Unlike many older stealers, CryptoBandits does more than grab one password file. It can capture seed phrases and private keys, upload screenshots of your desktop, and maintain remote access over the Tor network, effectively turning an infected PC into a small backdoor that attackers can task later with more actions such as additional data theft or ransomware deployment.

The campaign is harder to detect because it relies on native Windows scripting tools instead of big installer binaries, and it routes command and control traffic through a local Tor proxy and hidden .onion addresses rather than visible IPs. That combination of worm-like USB spread, high frequency clipboard theft, and anonymized control infrastructure makes it dangerous for both individual traders and organizations with hot wallets on Windows machines.

3. Practical Defenses Now

You can greatly lower exposure by adopting a few habits and controls:

1. Treat all USB drives as untrusted: avoid unknown sticks, disable AutoRun, and in corporate settings consider blocking `.lnk` execution from removable media and restricting script hosts like `wscript` and `cscript`.
2. For every transfer, manually verify the pasted destination address on screen against the intended address, especially for large amounts, rather than trusting the clipboard.
3. Keep security tools, especially Microsoft Defender, fully updated and run full scans if you ever plugged in an untrusted USB or see unexpected shortcut files where documents should be; move significant holdings to hardware or other cold wallets where keys never touch a general-purpose Windows machine.

Conclusion

Microsofts findings show that USB-borne clipper malware has evolved into a stealthy worm that can quietly hijack crypto flows and harvest wallet secrets from everyday Windows systems. The main defenses are operational rather than exotic: stop trusting random USB drives, lock down shortcut and script execution, and always verify wallet details before sending funds, especially when significant balances are involved.