Microsoft flags USB malware hijacking crypto wallets

TLDR

Microsoft has disclosed a new Windows malware campaign that spreads via USB drives and hijacks crypto wallets by tampering with copy paste operations.

1. Microsoft calls the malware CryptoBandits, a USB spreading crypto clipper that watches your clipboard, swaps wallet addresses, and steals seed phrases over the Tor network.
2. The worm also acts as a backdoor, letting attackers run code remotely, so a wallet theft incident can escalate into full device compromise and broader account takeover.
3. You can reduce risk by avoiding unknown USB drives, treating shortcut files with suspicion, double checking every pasted address, and keeping wallets and Windows security tools hardened and up to date.

Deep Dive

1. How CryptoBandits Works

Microsoft Threat Intelligence has identified a malware family, detected as Trojan:Win32/CryptoBandits, that has been active since at least February 2026 and is spreading via infected USB sticks on Windows systems. Reports describe it as a crypto clipper that installs when a user opens a malicious shortcut (.lnk) file from a USB drive, which then hides real documents and replaces them with identically named shortcuts that silently launch the malware when opened later.

Once installed, the malware runs a worm component and a stealer component. It scans the Windows clipboard roughly every 500 milliseconds for wallet addresses, seed phrases, and private keys, then either exfiltrates them over a bundled Tor client or silently replaces a copied destination address with one controlled by the attacker. This behavior is confirmed in multiple analyses of the campaign, including a detailed USB based crypto clipper write up.

2. Why It Is Dangerous

CryptoBandits targets high value financial artifacts such as BIP39 seed phrases and Bitcoin or Ethereum private keys, so a single clipboard capture can give attackers full control of a wallet, not just one transaction. Because it uses lookalike wallet addresses and operates in the background, many victims only notice the issue after funds have been irrevocably sent to an attacker controlled address.

Beyond theft, the malware sets up scheduled tasks, routes traffic through Tor, uploads screenshots, and can execute attacker supplied commands, turning an initial crypto focused compromise into a persistent backdoor that threatens exchanges, email, and other apps on the same machine.

3. Practical Protection Steps

From the published guidance, the highest impact defenses are behavioral and configuration based. Microsoft recommends disabling AutoRun or autoplay for removable media, blocking .lnk execution from USB drives in group policy where possible, and being extremely cautious with any USB device whose files suddenly appear as shortcuts instead of normal documents.

For crypto operations, always verify the full destination address on screen before signing, avoid storing seed phrases or private keys in plain text on general purpose computers, and prefer hardware wallets that display and confirm addresses on a separate secure screen. Keeping Windows, Microsoft Defender, and any other security tools updated helps, since CryptoBandits variants are now explicitly detected, but users still need to treat clipboard and removable media as high risk surfaces.

Conclusion

Microsofts findings show that malware authors are combining old school USB worms with modern crypto focused clippers to steal funds and gain long term access to Windows machines. For crypto users, the core defense is tightening basic hygiene around removable media, clipboard use, and key storage, so that even if such a campaign is circulating in the wild, there are fewer chances for it to silently hijack transactions or wallets.