Microsoft finds USB malware hijacking crypto wallets

TLDR

Microsoft has uncovered a new Windows malware, CryptoBandits/Crypto Clipper, that spreads via USB sticks and can silently hijack crypto wallet transactions.

1. The malware infects Windows PCs through booby trapped USB shortcut files, then monitors your clipboard to swap wallet addresses with attacker controlled ones.
2. It also searches for seed phrases, private keys, and wallet credentials, so a single infected machine can lead to a complete loss of funds.
3. The most effective defenses are strict USB hygiene, always verifying recipient addresses, and keeping keys on hardware wallets or other offline storage.

Deep Dive

1. What Microsoft Found

Microsoft security researchers describe a campaign detected by Defender as Trojan:Win32/CryptoBandits.A, also called a crypto clipper, active since at least February 2026 and focused on draining crypto wallets on Windows PCs. Reports note that it spreads through USB storage devices using malicious .lnk shortcut files that mimic normal documents and replicate to other drives when opened.

Once installed, the malware continuously watches the clipboard for cryptocurrency addresses and can substitute them with lookalike addresses controlled by the attacker, targeting networks like Bitcoin, Tron, and Monero. Several analyses highlight its use of Tor based command and control to hide traffic and maintain remote access to compromised systems.Microsoft has identified this Crypto Clipper campaign.

2. Why It Is Dangerous For Crypto Users

This is not just an address swapper. Microsoft and follow up reports say CryptoBandits/Clipper also scans for 12 or 24 word seed phrases, private keys, and wallet credentials stored in files or copied to the clipboard, and can capture screenshots to see which wallets and balances you have.A detailed write up on Windows clipper malware makes clear that it monitors for exactly the data crypto users cannot afford to leak.

If you confirm a transaction after the address has been swapped, the transfer will usually be irreversible. If a seed phrase or private key is exposed, attackers can simply import the wallet elsewhere and empty it, regardless of future security steps on the original device.

3. Practical Defenses To Apply Now

Microsofts guidance and security experts converge on a few concrete habits:

1. Avoid plugging in unknown or untrusted USB drives and disable AutoRun where possible, since this campaign relies on removable media to spread.
2. Treat any USB that suddenly shows all files as shortcuts as suspect and scan it with up to date security tools before opening anything.
3. Always verify the full recipient address on a trusted device or hardware wallet screen before signing, instead of relying on what you copied and pasted.

For key storage, using hardware wallets or other offline key storage greatly reduces the impact of this kind of Windows malware, because seed phrases and signing keys never live on the general purpose machine that may be infected.

Conclusion

Microsofts finding highlights that old school USB infections are now tightly linked to modern crypto theft, combining worm style spread with targeted clipping of wallet activity. For crypto users, the main defenses are behavioral and architectural: strict caution with removable media, consistent verification of destination addresses, and keeping private keys off everyday Windows devices where possible.