Microsoft has identified a self-spreading malware that targets cryptocurrency wallets on Windows computers and has been circulating on infected USB drives since February, the company said in a June 17 security blog post. Its Defender Antivirus flags the program as Trojan:Win32/CryptoBandits and classifies it as a “crypto clipper.” Once a victim plugs in a tainted drive and opens a disguised shortcut file, the software installs a worm that reads the Windows clipboard for wallet credentials, sends them to an attacker over the Tor network, and can silently swap a payment address for one the attacker controls. A seed phrase is the list of words that acts as the master key to a crypto wallet, and anyone who obtains it controls the funds inside.
Key takeaways
- Microsoft says a USB-borne worm it calls Trojan:Win32/CryptoBandits has targeted Windows crypto wallets since February 2026.
- The malware reads the clipboard about every 500 milliseconds for seed phrases and private keys, then exfiltrates them over Tor and grabs five screenshots.
- It also swaps a copied recipient address for an attacker-controlled one, so funds leave the wallet without any visible warning.
- Microsoft urged users to disable AutoRun, block .lnk execution on USB media, and restrict Windows script hosts.
Published: June 19, 2026, 16:00 UTC
How the worm gets in
The attack starts with an infected USB drive that carries a malicious shortcut, or “link,” file. In Windows, shortcut filenames end in .lnk and tell the operating system to open a program or document stored elsewhere. The worm hides the real files on a drive and replaces them with shortcuts that use the same names, so a victim who clicks what looks like a Word document instead launches a hidden script.
That click installs the worm, which then runs two jobs at once. It executes the wallet-stealing code on a loop, and it waits for the next clean USB drive to be connected so it can copy itself across. Microsoft says the program has spread this way since February, making it a slow-burning campaign rather than a one-time breach.
What it steals, and the address-swap trap
The wallet-stealing component watches the Windows clipboard, the temporary memory used for copy-and-paste, roughly every 500 milliseconds. When a user copies a Bitcoin or Ethereum seed phrase or private key, the malware captures it and ships it to the attacker’s server through Tor, an anonymizing network that masks where the data goes. It also takes five screenshots, ten seconds apart, and sends those along.
The second danger is harder to spot. A crypto clipper is malware that silently replaces a cryptocurrency address copied to the clipboard with one belonging to the attacker. If a user copies a recipient address to send funds, the worm substitutes its own address before the user pastes, so the transfer goes to the attacker with no visible cue. Because wallet addresses are long strings most people do not read in full, the swap routinely slips past victims until the money is gone.
The threat lands during a fragile stretch for the market. Bitcoin slid below $63,000 this week, and self-custody users moving coins off exchanges are exactly the audience an address-swapping clipper is built to catch.
How to protect a wallet
Microsoft recommends disabling AutoRun for removable media, blocking .lnk file execution on USB drives through group policy, and restricting script hosts such as wscript.exe and cscript.exe. Defender customers can run hunting queries to look for related activity, including connections to a local Tor proxy on port 9050. The company also published indicators of compromise, including file hashes and the .onion command-and-control domains the worm contacts, so security teams can scan their networks.
For individual holders, the practical defense is to avoid plugging untrusted USB drives into a machine that touches a wallet, never copy a seed phrase or private key on an internet-connected computer, and manually verify the first and last characters of any address before sending. Hardware wallets that display the destination address on the device itself defeat the clipboard swap, because the address shown on the screen does not come from the clipboard.
Frequently asked questions
What is a crypto clipper?
A crypto clipper is malware that monitors a computer’s clipboard and replaces a copied cryptocurrency address with one controlled by an attacker. When the victim pastes the address to send funds, the payment goes to the attacker instead, usually without any visible warning.
How does the CryptoBandits worm spread?
It spreads through infected USB drives. The worm hides real files on a drive and replaces them with identically named shortcut files. Opening one installs the worm, which then runs the wallet-stealing code and copies itself onto the next clean USB drive plugged into the machine.
How can I protect my crypto wallet from this malware?
Avoid plugging untrusted USB drives into a computer used for crypto, disable Windows AutoRun, and never copy a seed phrase or private key on an internet-connected machine. Using a hardware wallet that shows the destination address on its own screen also defeats the clipboard address swap.
