Microsoft flags new USB malware draining crypto

TLDR

Microsoft has alerted users to a new Windows USB malware that steals crypto by hijacking clipboards and seed phrases.

1. The malware, detected as CryptoBandits.A, spreads via infected USB sticks and shortcut files, then swaps copied crypto addresses and exfiltrates seed phrases.
2. It targets Bitcoin (BTC), Tron (TRX), Monero (XMR) and other wallets, and can defeat self custody if it compromises the computer you use for wallet operations.
3. Reducing risk focuses on USB and endpoint hygiene: disable autorun, block untrusted shortcuts and scripts, verify addresses, and rotate wallets if you suspect exposure.

Deep Dive

1. How The Malware Works

Microsoft describes a new USB based "clipper" malware that infects Windows PCs via malicious shortcut (.lnk) files on flash drives, replacing normal files with booby trapped shortcuts that run the payload when clicked instead of opening documents or folders. The malware then copies itself to every USB drive plugged into the infected machine, turning routine thumb drive usage into a propagation vector on air gapped or semi offline systems, according to a recent security notice about the USB based clipper.

Once installed, it runs a tight loop that checks the clipboard roughly every 500 milliseconds for crypto addresses and BIP39 12 or 24 word seed phrases, then replaces copied addresses with attacker controlled ones and uploads any detected seeds plus screenshots over Tor, as detailed in Microsoft focused research on CryptoBandits.A.

2. Who Is At Risk And Why

The malware has been observed specifically watching for Bitcoin, Tron and Monero style addresses, but the underlying technique works for any clipboard based transaction workflow, so the risk applies broadly to crypto users who paste addresses.

It also actively hunts for seed phrases, private keys and wallet files, so it threatens both hot wallets and self custodial setups that ever expose secrets on an infected Windows machine, including when exporting a seed from a hardware wallet and briefly viewing it on screen.

Endpoint compromise like this cannot be fixed on chain: once a seed is exfiltrated, attackers can rebuild the wallet and drain it at will.

3. Practical Defenses And Hygiene

Microsoft recommends disabling AutoRun and AutoPlay for all removable media and blocking execution of .lnk shortcuts from USB drives, since these are the primary infection path highlighted in its USB malware warning.

Additional hardening from the CryptoBandits.A analysis includes restricting script engines (for example Windows Script Host, PowerShell), monitoring for suspicious clipboard polling or Tor like proxy activity, and treating any shared or work PC that uses lots of USB sticks as high risk.

If you suspect exposure, the safest course is to move funds to new wallets created on a clean device, rotate any seeds that may have been visible, and review transaction history for unexplained transfers.

Conclusion

This USB based clipper shows that many successful crypto thefts now come from attacking the computers around wallets, not the blockchains themselves. The main defenses are strict control of USB usage, scripts and endpoints you use for wallet operations, plus disciplined address verification and timely rotation of keys when in doubt.