Microsoft warns of new USB crypto malware

TLDR

Microsoft has identified a new USB-based clipper malware that targets crypto users on Windows by hijacking wallets and seed phrases.

1. The malware spreads via infected USB drives, uses shortcut files, and runs persistently while scanning for crypto data on Windows devices.
2. It steals 12 or 24-word seed phrases, monitors clipboard crypto addresses (Bitcoin, Tron, Monero, etc.), and swaps them for attacker-controlled addresses.
3. Protecting against it mostly involves hygiene: avoid untrusted USBs, disable autorun and shortcut execution from removable drives, and verify addresses before sending crypto.

Deep Dive

1. How The Malware Works

According to a Microsoft Defender alert summarized by Bitcoin.com, this is a lightweight script-based clipper that spreads through USB flash drives using Windows shortcut (.lnk) files as the trigger for infection on new machines.

Once active, it replaces files on removable media with shortcuts, copies itself to any USB plugged into an infected PC, and communicates with its operators over Tor to reduce traceability. It runs continuously in the background, scanning memory and clipboard contents every few hundred milliseconds for crypto-related data such as wallet addresses and seed phrases.

2. Why Crypto Users Are At Risk

The malware specifically looks for high-value financial artifacts, including 12 or 24-word BIP39 seed phrases, and sends them to attackers together with screenshots to show wallet context and balances. It also watches for crypto addresses, with reports highlighting Bitcoin, Tron, and Monero as examples of targets, and silently replaces copied addresses with lookalike ones controlled by the attacker, diverting any outgoing funds.

This turns routine actions like copying a deposit address or briefly pasting a seed phrase into a text field into critical failure points, because a single successful capture can compromise entire wallets.

3. How To Protect Yourself

Practical steps aligned with Microsofts guidance include:

1. Disable autorun and block shortcut (.lnk) execution from removable drives wherever possible, since this is the main propagation path.
2. Avoid plugging unknown or shared USB sticks into machines that you use for crypto, and consider keeping a clean device for wallet operations only.
3. Always verify crypto addresses character by character (at least the first and last few) before confirming a transaction, and never type or paste seed phrases on an internet-connected Windows PC if you can avoid it.

Keeping Windows and Microsoft Defender up to date, and rescanning any device you suspect may have used an infected USB, further reduces risk.

Conclusion

Microsofts warning highlights that low-tech vectors like USB sticks remain a serious threat to crypto security, because they attack the endpoint rather than the blockchain. If you use Windows for wallets or exchanges, the real defense is careful device and USB hygiene, strict handling of seed phrases, and diligent address verification before you send any funds.