Microsoft warns of USB-spreading crypto-stealing malware

Microsoft has issued a warning about a sophisticated, self-propagating malware campaign that has been targeting Windows users since February, stealing cryptocurrency credentials and establishing persistent backdoor access. The malware, detected as Trojan:Win32/CryptoBandits.A, spreads primarily through infected USB drives and uses the Tor network to conceal its operations.

The attack begins when a user opens a malicious shortcut file (.lnk) from a compromised USB drive. This triggers a worm component that scans the device for common document files, hides them, and replaces them with malicious shortcuts bearing the same names. The malware also creates scheduled tasks to ensure it runs after a system reboot and automatically copies itself to any new USB drive connected to the infected computer, enabling further spread.

Once active, the malware functions as a "crypto clipper," monitoring the system's clipboard approximately every 500 milliseconds. It searches for high-value financial data, including 12 or 24-word BIP39 seed phrases and private keys for Bitcoin and Ethereum wallets. When it detects a cryptocurrency wallet address being copied-for networks including Bitcoin,...