Microsoft Discovers Malware Targeting Crypto Wallets via USB

New malware identified as a "crypto clipper" steals private keys and alters wallet addresses during transactions.

Microsoft has revealed the existence of a malware strain that has been compromising cryptocurrency wallets via USB drives since February. This harmful software, known as a "crypto clipper," is recognized by Microsoft Defender Antivirus as Trojan:Win32/CryptoBandits.

The malware spreads when a user connects an infected USB drive containing a malicious .lnk shortcut file. Activating this shortcut installs a worm on the computer, which then begins monitoring the clipboard for sensitive information, including seed phrases and private keys. This data is sent to the attacker's server using the Tor network, which facilitates anonymous data transmission.

Additionally, the malware is designed to replace recipient wallet addresses with those controlled by the attacker, ensuring that any transferred funds are redirected without the user's knowledge. It also takes screenshots periodically, capturing further information about user activity.

The infection can propagate by overwriting files on clean USB drives with new shortcut files, thus continuing the cycle of infection whenever a new USB is connected. To mitigate this threat, Microsoft has advised users to disable AutoRun for USB devices and restrict the execution of .lnk files through group policy settings. They also recommend monitoring network activity for indicators of compromise, including connections to Tor proxies.

A detailed list of file hashes and .onion domains used by the malware has been published to aid security teams in identifying potential threats within their networks.