Microsoft uncovers USB malware hijacking crypto wallets

TLDR

Microsoft has disclosed CryptoBandits, a Windows malware campaign that spreads via infected USB drives and hijacks crypto wallets by stealing seed phrases and silently swapping copied addresses.

1. CryptoBandits infects Windows PCs through malicious shortcut files on USB sticks, then uses Tor and Windows scripting tools to stay hidden and persist.
2. The malware monitors the clipboard every half second, steals seed phrases and private keys, and replaces recipient wallet addresses to divert transfers to attacker wallets.
3. Crypto users can reduce risk by avoiding unknown USBs, blocking .lnk execution on removable drives, verifying addresses, and using hardware wallets and up to date security tools.

Deep Dive

1. How CryptoBandits Infects Devices

Microsoft tracks the campaign as Trojan:Win32/CryptoBandits.A, a crypto clipper worm active since February 2026 that targets Windows systems and spreads primarily via USB storage devices. When an infected USB is plugged in, legitimate documents such as PDFs and Word files are hidden and replaced with identically named .lnk shortcut files that actually launch the malware when opened, as described in reports aggregated by CoinDesk and others about malware that hijacks crypto wallets and spreads through USB sticks.

Once running, the worm installs script based components, creates scheduled tasks for persistence, deploys a portable Tor client, and routes command and control traffic through .onion addresses. Using Tor and native Windows tools makes it harder for simple file signature based antivirus checks to spot.

2. What It Steals From Crypto Users

CryptoBandits continuously checks the Windows clipboard roughly every 500 milliseconds for sensitive crypto data, including wallet addresses, 12 or 24 word seed phrases, and private keys. If you copy a destination address to send funds, the malware can silently replace it with an attacker controlled lookalike address so the transaction goes to the attacker instead, according to Microsofts description of a USB based crypto clipper that performs high frequency clipboard theft and wallet address substitution on Windows users wallets.

It also exfiltrates any detected seed phrases or keys over Tor, can take screenshots of wallet activity, and supports remote code execution, effectively turning infected machines into lightweight backdoors that can later be used for broader compromise or ransomware. So far, this campaign is described as Windows focused, not as a confirmed threat to macOS or Linux.

3. Key Protection Steps To Take

Practical defenses focus on both behavior and configuration:

1. Avoid unknown or shared USB drives, disable AutoRun, and treat any drive where familiar documents suddenly appear as shortcuts as potentially infected.
2. On Windows, administrators can block .lnk execution from USB media, restrict script hosts like wscript and PowerShell for regular users, and monitor for Tor proxy traffic on localhost ports, which Microsoft highlights as useful detection points in its guidance on CryptoBandits behavior.
3. For day to day usage, always verify the full destination address on a trusted screen before signing a transaction, prefer hardware wallets that show the address on device, and keep Defender or other security tools fully updated.

Conclusion

Microsofts discovery of CryptoBandits shows that clipboard hijacking malware has evolved into worm like USB campaigns with Tor based backdoors, turning a simple copy paste habit into a high impact theft vector. For crypto users and organizations, the main defense is not a single tool but a combination of USB hygiene, strict address verification, hardened Windows policies, and hardware wallet based signing so that even if a desktop is compromised, attackers cannot silently redirect or drain funds.