Microsoft says a malware targeting Windows users has been spreading since February. It enters computers via infected USB devices and aims to steal mnemonic phrases, private keys, and transfer addresses from encrypted wallets, replacing the receiving address during transfers.
Implant via shortcut
Microsoft classifies this type of malware as a crypto clipper, while Defender Antivirus identifies it as Trojan:Win32/CryptoBandits. Attacks typically begin with an infected USB device containing a malicious .lnk shortcut file.
Once the user clicks the file, the worm will install itself on the computer. It then continues to run code that steals wallet information while waiting for a new, clean USB device to be connected to continue spreading.
Check clipboard every 500 milliseconds
After installation, the program continuously monitors the contents of the Windows clipboard. Once it detects a mnemonic phrase, private key, or wallet address such as Bitcoin or Ethereum, it collects the relevant data and sends it to the attacker via the Tor network.
Microsoft states that the program also periodically captures and uploads screenshots. If a user copies a money transfer address, the malicious program will silently replace it with an attacker-controlled address before pasting, which is usually difficult for the user to detect in time.
Even clean USB drives can become infected.
When a new USB device is plugged into an infected computer, the worm scans for common files, including Word, Excel, and PDF documents. It then replaces these files with shortcuts of the same name, turning the USB device into a new medium for propagation.
- Transmission method: .lnk files in infected USB drives.
- Main objectives: mnemonic phrase, private key, payment address
- Risky action: Replace address and infect new USB.
Microsoft has released a set of intrusion indicators, including file hashes and .onion domains used for control communications, for security teams to investigate network environments. The company also recommends disabling AutoRun and blocking .lnk files from USB media.
