Microsoft warns of USB-spreading malware that steals crypto wallet keys

Microsoft has identified a worm called Trojan:Win32/CryptoBandits that spreads via USB drives, steals crypto wallet seed phrases and private keys, and swaps recipient addresses during transfers.

• The malware has been infecting Windows PCs since February, spreading through infected USB drives with malicious .lnk shortcut files.
• Once installed, it monitors the clipboard every 500ms for seed phrases, private keys, and wallet addresses, exfiltrating data over the Tor network.
• It can silently replace a copied recipient address with an attacker's address before the user pastes it, redirecting funds.
• The worm propagates by replacing documents on clean USB drives with identically named shortcut files, continuing the infection cycle.
• Microsoft recommends disabling AutoRun, blocking .lnk execution on USB media, and restricting script hosts to prevent infection.

Coinporta summarises news for fast scanning. Full reporting belongs to the source.

Last updated 20 Jun 2026