Microsoft Warns Crypto Clipper Malware Is Spreading Through USB Drives

223 views
Microsoft Warns Crypto Clipper Malware Is Spreading Through USB Drives

Microsoft has warned that a Windows-based crypto clipper campaign has been active since February, using infected USB drives, malicious shortcut files and Tor-based command traffic to steal wallet data and replace copied crypto addresses.

The Microsoft Security research describes a campaign that combines clipboard theft, wallet-address substitution, seed-phrase collection, screenshot capture and remote code execution. Microsoft Defender Antivirus detects the threat as CryptoBandits, with components tracked across Windows and JavaScript payloads.

The malware targets one of the most common crypto transfer habits: copying and pasting wallet addresses. Once active on a Windows device, it watches the clipboard roughly every 500 milliseconds. If a user copies a crypto address, the malware can replace it with an attacker-controlled address before the user pastes it into a wallet or exchange withdrawal form.

USB Shortcuts Turn The Malware Into A Worm

The campaign spreads through malicious .lnk shortcut files found on USB storage devices. When a user opens what looks like a normal file shortcut, the payload stages a worm component and a separate clipper-stealer component.

Microsoft said the worm scans removable media for common documents such as PDFs, spreadsheets and Word files, hides the originals, then creates malicious shortcuts using the same filenames. That keeps the infection chain moving because the next user may think they are opening an ordinary document while actually launching the worm.

The malware also creates scheduled tasks for persistence and uses script-based execution through Windows Script Host and ActiveX. That makes the campaign more flexible than a simple one-file stealer, especially when it can keep running after reboot and continue monitoring clipboard activity.

Seed Phrases And Tor Raise The Risk

The clipper does not only swap recipient addresses. Microsoft said the malware checks clipboard data for wallet patterns, seed phrases and private keys, including 12-word and 24-word BIP39 phrases. It can save stolen material locally, exfiltrate it through Tor and upload screenshots for additional visibility into the victim’s device.

The Tor setup is central to the campaign. The malware launches a renamed portable Tor binary, routes traffic through a local SOCKS5 proxy on localhost:9050 and communicates with hidden-service command servers. That reduces the visibility defenders normally get from exposed IP infrastructure or ordinary DNS traffic.

This makes the campaign more serious than a basic clipboard hijacker. Wallet-address replacement can steal one outgoing transaction, but seed-phrase theft can drain every wallet restored from the same recovery phrase. A recent case involving a Ledger user losing about $1 million after entering a seed phrase into a fake support site showed how quickly recovery-phrase compromise can turn into a total wallet loss.

Crypto Malware Keeps Moving Closer To The Endpoint

Microsoft’s warning fits a wider shift in crypto theft. Attackers are not always trying to break blockchains or exploit smart contracts. Many campaigns now target the endpoint: the laptop, USB drive, browser profile, developer workstation or clipboard sitting between the user and the transaction.

That same endpoint pressure showed up in the TrapDoor malware campaign targeting crypto and AI developers, where malicious packages were built to steal wallet data, GitHub tokens, SSH keys, API keys and local configuration files from development environments.

The strongest defense is not only checking the first and last characters of a wallet address. Users handling crypto transfers should verify the full destination address on a trusted screen, avoid unknown USB drives, disable AutoRun or AutoPlay on removable media, keep endpoint protection active and treat any clipboard change as a sign of device compromise.

Bitcoin coin symbol
Btc
Bitcoin
$81.532
price
green chart
increase symbol0.38691%
price change
TRADE NOW

Microsoft’s campaign analysis puts the warning in plain terms: the theft path starts before the transaction is signed. Once a Windows device is compromised, a copied address, seed phrase or private key can become the attacker’s next route into funds.

Previous

Ethereum Core Dev Funding Warning Hits As EF Pullback Raises 3–9 Month Risk

Next

Kentucky Targets Kalshi And Polymarket In Illegal Sportsbook Lawsuits

Written by

glenn nästa

Glenn Nasta

@glennnasta

432 posts

Glenn is a long-time crypto enthusiast and active day trader. He quickly acknowledged the potential of blockchain technology and the benefits of decentralization. Glenn believes in a future where blockchain technology and decentralization will govern and provide financial freedom.

VIEW AUTHOR

Publish your own article

Guest post article. Guaranteed publishing with just a few clicks

START PUBLISHING ADVERTISE WITH US

Browse categories

Explore trending topics in the crypto community right now.

Bitcoin

JPMorgan Forecasts 10% Annual Bitcoin Returns, Outpacing Stocks and Gold

JPMorgan Asset Management has introduced a 10% annualized return forecast for Bitcoin in its 2027 Long-Term Capital Market Assumptions, placing the cryptocurrency ahead of U.S. large-cap equities, gold and several traditional asset classes over the next 10 to 15 years. Released on October 19, the 31st edition marks JPMorgan's first formal inclusion of Bitcoin in its long-term return projections, extending the bank's institutional investment framework into cryptocurrency. The 10% base-case assumption exceeds the bank's 7.5% annual forecast for U.S. large-cap...

Bitcoin and Ethereum Plunge as Hot U.S. CPI Sparks Nearly $1 Billion in Crypto Liquidations

Bitcoin and Ethereum extended their losses on October 15 after hotter-than-expected U.S. inflation data rattled financial markets, triggering nearly $1 billion in cryptocurrency liquidations as leveraged traders faced another wave of forced selling. Bitcoin fell toward $80,000, trading around $81,000 after retreating from levels above $83,000 before the inflation release. Ethereum suffered heavier losses, dropping more than 6% over 24 hours to approximately $2,365. The sell-off followed the October 14 release of September's Consumer Price Index (CPI), which showed annual...

Standard Chartered Launches Bitcoin and Ethereum Trading for Wealthy UAE Clients

Standard Chartered has launched cryptocurrency trading for affluent clients in the United Arab Emirates, allowing eligible investors to buy and sell Bitcoin and Ethereum directly through their existing bank accounts. The October 14 launch marks the bank's first cryptocurrency trading offering for wealth clients globally and the first such service introduced by an international bank in the UAE. The offering has received licensing approval from Dubai's Virtual Assets Regulatory Authority (VARA) and initially targets customers classified as Professional Investors. Transactions,...

Strategy Buys 250 Bitcoin and Repurchases $192M in STRC as Holdings Reach 848,250 BTC

Michael Saylor's Strategy has acquired another 250 Bitcoin and repurchased approximately $192 million of its STRC preferred stock, continuing to deploy capital across its cryptocurrency treasury and securities repurchase programs. The October 12 corporate disclosure puts Strategy's total holdings at 848,250 BTC as of October 11, alongside approximately $5.5 billion in combined U.S. dollar reserves and deployable cash. The latest Bitcoin purchase cost $21.5 million, with $21 million funded through sales of MSTR common shares and another $500,000 drawn from...

MORE ARTICLES

Ethereum

Abstract Ethereum Layer 2 to Shut Down on December 15 With $47.9M Still Secured

Abstract, the consumer-focused Ethereum Layer 2 backed by Pudgy Penguins parent Igloo Inc., will shut down on December 15, 2026, ending a nearly three-year effort to build a blockchain around consumer crypto. Users must move their assets before the deadline through Abstract’s official Migration Hub or native bridge. Assets remaining on the network after December 15 will become inaccessible. The native bridge currently carries an expected withdrawal delay of roughly three hours. The October 6 wind-down notice also warned users...

Ledger Patches Ethereum Signing Flaw Before Researchers Disclose It

Ledger has patched a vulnerability in its Ethereum hardware-wallet app that could allow a malicious dApp to replace a transaction during the approval process while the device continued showing users the transaction they originally reviewed. Security firm TestMachine disclosed the signature-substitution flaw on August 21 after reproducing it on Ledger hardware. Ledger had already shipped Ethereum app version 1.22.2 on August 12, with its release history listing security fixes for the update. Malicious dApp Could Change the Transaction Before Signing...

Jesse Pollak Pushes Back On Coinbase ETH Selling Criticism, Points To 150K ETH Treasury

Base creator Jesse Pollak has pushed back against criticism that Coinbase is selling ETH while benefiting from Ethereum, pointing to the exchange’s roughly 150,000 ETH corporate position and years of investment across the network. Pollak argued that Coinbase has held about 150,000 ETH through multiple market cycles, while describing the company as the largest ETH holder outside dedicated digital asset treasury companies by a wide margin. Coinbase’s latest regulatory filing backs up the scale of that position. The company held...

Tornado Cash Phishing Frontend Drains 1,010 ETH From User

A crypto user lost 1,010 ETH after following an old Tornado Cash bookmark into a phishing frontend that captured the private withdrawal credentials needed to access the deposited funds. The victim deposited the ETH into legitimate Tornado Cash contracts, but the malicious interface obtained the private note generated during the process. The attacker then used those credentials to withdraw the assets within roughly 12 hours without compromising the underlying Tornado Cash smart contracts. Phishing Frontend Targeted Private Withdrawal Notes Tornado...

MORE ARTICLES

Trading

5 Best Crypto APIs for Trading Bots in 2026

A crypto trading bot is a chain of dependencies. It reads a position, prices it, decides, places an order, and confirms settlement. Every one of those steps is an API call, and a failure at any single step stops the strategy. The provider choice shapes what a bot can actually do more than the strategy logic does. The common mistake is searching for one API that covers everything. No such API exists in 2026. Market data providers do not route...

Best Prediction Markets Alternatives: Outpoll, Limitless, Myriad, Manifold

Polymarket and Kalshi helped turn prediction markets into a mainstream trading category, but neither platform fits every trader. Access varies by country, market selection can lean heavily toward certain topics, and the tools available for entering, managing, and automating positions differ sharply across platforms. The strongest alternatives are not identical copies. Some emerging prediction markets platforms focus on professional order controls, some concentrate on fast crypto and financial markets, and others use onchain infrastructure or play-money forecasting. Users unfamiliar with...

How to Get a Funded Crypto Trading Account in 2026 Step by Step

A funded crypto trading account gives a trader access to more notional capital after they prove they can follow a firm’s risk rules. The usual route starts with a paid crypto prop firm challenge that requires a profit target without breaching daily or overall loss limits. Passing is not only about making money. Drawdown control, minimum trading days and rule compliance determine whether the account survives. The evaluation fee can be lost, and crypto prop firms use different account models,...

How To Trade Tokenized Stock Perps: Leverage, Funding And Risks

Tokenized stock perps allow traders to take long or short exposure to companies, ETFs and equity indexes through crypto-native derivatives markets. Positions can use stablecoin collateral, remain open without an expiry date and continue trading when the main stock exchange is closed. The trader receives price exposure, not ownership of the referenced shares. The interface often looks identical to a crypto perpetual futures market. The risk does not. A stock-linked contract can remain active overnight, through weekends and during holidays...

MORE ARTICLES

Tech

Polymarket Fires CMO Matthew Modabber After Fake-Bet Marketing Probe

Polymarket has dismissed Chief Marketing Officer Matthew Modabber following an internal investigation into controversial marketing practices that drew regulatory scrutiny and raised concerns among the prediction market platform's investors. The October 22 departure ends Modabber's tenure as one of Polymarket's earliest executives and a longtime confidant of founder and CEO Shayne Coplan. The investigation examined allegations involving staged betting videos, undisclosed influencer payments and promotional campaigns that presented simulated trades as genuine winnings. Polymarket is reportedly finalizing Modabber's separation agreement....

World Launches World ID Banking Suite to Fight Deepfake Fraud

World, the digital identity project co-founded by OpenAI CEO Sam Altman, has launched a World ID suite for banking and finance, introducing identity verification tools designed to protect financial institutions against AI-generated impersonation, fraudulent transactions and unauthorized account access. Unveiled by co-founder Alex Blania at Money20/20 in Las Vegas on October 18, the offering combines a dedicated identity wallet, real-time verification for Zoom meetings and cryptographic credentials that AI agents can use when acting on behalf of verified individuals. Bain...

MSCI Finalizes Rules That Could Remove Strategy and Metaplanet From Global Indexes

MSCI has finalized new eligibility rules that could remove Michael Saylor's Strategy (MSTR) and Japan's Metaplanet from its Global Investable Market Indexes, potentially triggering billions of dollars in passive fund selling. The decision introduces broader restrictions on companies classified as non-operating businesses, following months of consultation over whether Bitcoin treasury companies belong in traditional equity benchmarks. The changes will take effect with MSCI's November 2026 Index Review. Strategy and Metaplanet have not yet been formally removed. An earlier MSCI simulation,...

Binance to Shut Down Binance Pool and Cloud Mining Services on November 10

Binance will permanently discontinue Binance Pool and its associated mining services on November 10, 2026, ending support for mining connections, cloud mining products, savings accounts and transaction acceleration features. The shutdown takes effect at 07:00 UTC, when Binance will disable mining endpoints and stop accepting new hashrate submissions. Miners must redirect their equipment to alternative pools before the deadline to avoid interruptions. The October 13 closure notice covers Binance Pool, Pool Savings, Cloud Mining, Transaction Accelerator, Telegram hashrate alerts, email...

MORE ARTICLES