Microsoft warns USB malware targets crypto users

TLDR

Microsoft has alerted Windows users to new USB-spreading malware that specifically steals crypto funds and wallet secrets.

1. The malware spreads via infected USB drives, installs through shortcut files, and then hijacks crypto transactions by swapping addresses.
2. It actively hunts for Bitcoin (BTC), Tron (TRX), and Monero (XMR) addresses and even BIP39 seed phrases, making both hot and cold wallets vulnerable on infected machines.
3. Main defenses are locking down USB autorun, treating all removable drives as untrusted, and never exposing seed phrases or wallets on general-purpose Windows PCs.

Deep Dive

1. How The Malware Works

Microsoft reported a lightweight USB-propagating clipper malware that was flagged by Microsoft Defender in June 2026 and documented in detail by security researchers. The malware was described as a new USB-based threat targeting crypto users on Windows, spreading via flash drives and other removable media and then hijacking transactions once a device is infected.

According to one technical writeup of Microsofts alert, the malware replaces files on USB drives with Windows shortcut (.lnk) files; when a victim clicks these, the malware installs, then copies itself to any USB device subsequently connected, and communicates over Tor to avoid detection. It scans the clipboard roughly every 500 milliseconds for cryptocurrency addresses and replaces Bitcoin, Tron, and Monero addresses with attacker-controlled ones, silently redirecting outgoing transfers. It also searches clipboard data for 12 or 24-word BIP39 seed phrases and grabs several screenshots to give attackers context about your wallets and balances.

2. Why Crypto Users Are Exposed

Clipboard clipper malware has existed for years, but this campaign is more dangerous for crypto users because:

1. USB spread bypasses many users normal browsing hygiene and can jump between home, office, and shared computers.
2. It targets privacy coins like XMR and networks like TRX as well as BTC, so it is not limited to one ecosystem.
3. By hunting seed phrases, it threatens entire wallets, including coins that were never directly transacted on the infected machine.

For users who keep air-gapped or cold wallets on machines that occasionally read USB drives, this vector is especially concerning: an infected USB can turn that supposedly isolated computer into a compromised environment the moment a shortcut is executed.

3. Practical Risk Mitigation

From Microsofts guidance and standard security practice, the key defenses are:

1. Disable autorun for removable media and block execution of shortcuts from USB drives wherever possible.
2. Treat all USB sticks as untrusted; do not plug random drives into machines that hold wallets or seed backups.
3. Never type or paste seed phrases or private keys on a day-to-day Windows machine; keep them offline and separate from devices used for general browsing.

If you suspect infection, move assets to fresh wallets created on a known-clean device and avoid reusing any exposed seed phrases.

Conclusion

This campaign shows how old school USB malware is being adapted specifically to steal crypto by watching your clipboard and hunting for wallet secrets. For crypto users, the biggest edge is operational discipline: keep signing devices and seed storage off everyday Windows boxes, lock down USB behavior, and assume any shared or random drive can carry malware that quietly redirects your next transaction.