Microsoft disclosed in a blog post that a malware family spread via USB flash drives has been infecting Windows personal computers since February 2026, specifically targeting cryptocurrency wallets. The company describes it as a "crypto clipper" and its Defender Antivirus identifies it as Trojan:Win32/CryptoBandits.
Infection via Malicious .lnk Files
The attack begins with an infected USB drive containing a malicious shortcut (.lnk) file. When a user plugs in the drive and clicks the shortcut, a worm-type malware installs onto the PC. Once active, the worm constantly runs the wallet-stealing routine while simultaneously waiting for a new, clean USB to be plugged in, ready to propagate further.
Clipboard Monitoring and Address Replacement
The wallet-stealing component monitors the Windows clipboard every 500 milliseconds. If a user copies a seed phrase or private key for a Bitcoin or Ethereum wallet, the malware captures the data and exfiltrates it to the attacker's server over the Tor network. It also takes five screenshots, ten seconds apart, and sends them along.
Even more deceptive: when a user copies a recipient address to send funds, the worm silently replaces it with an address controlled by the attacker before the user pastes, causing funds to be sent to the attacker with no visible cue.
Self-Replication Cycle
When a clean USB drive is inserted, the worm scans it for common files (Word docs, Excel sheets, PDFs), replaces them with identically-named .lnk files, and infects the drive. The cycle repeats when the infected USB is inserted into another computer.
Mitigations and Detection
Microsoft recommends disabling AutoRun for removable media, blocking .lnk execution on USB drives via Group Policy, and restricting script hosts like wscript.exe and cscript.exe. Defender customers can run hunting queries to check for connections to a local Tor proxy on port 9050. Microsoft also published a list of indicators of compromise, including file hashes and .onion command-and-control domains, for security teams to check their networks.
Crypto asset holders should regularly scan for such malware and avoid using wallets on untrusted machines.