CryptoBandits Malware Uses USB Drives to Steal Crypto Wallets

Microsoft has identified a new strain of crypto-targeting malware that turns something as mundane as a shared USB drive into a full wallet-compromise operation. CryptoBandits malware, formally detected as ‘CryptoBandits.A,’ has been active since at least February 2026 and represents one of the more tactically complete theft frameworks Microsoft’s security team has publicly documented in the crypto space — combining physical-world propagation, clipboard interception, and Tor-routed command traffic into a single, persistent attack chain.

• CryptoBandits malware spreads through malicious USB shortcut files, disguising itself as ordinary documents to infect Windows machines.
• CryptoBandits malware polls the clipboard every 500 milliseconds, intercepting seed phrases and swapping wallet addresses before transactions confirm.
• The malware routes stolen data through Tor, making command-and-control traffic harder to trace or block at the network level.
• Microsoft first detected the threat in February 2026, but has not disclosed total theft figures or identified who is behind it.

How CryptoBandits Malware Turns a USB Drive Into a Trap

The initial infection vector is deliberately low-tech, which is exactly what makes it effective. CryptoBandits malware enters a system through malicious Windows shortcut files — .lnk files — placed on USB storage devices. When someone plugs in an infected drive and clicks what appears to be a Word document, a spreadsheet, or a PDF, they’re not opening a file. They’re executing a worm payload.

The mechanics are straightforward but deceptive. According to Microsoft’s Security Blog report published June 17, the malware scans the USB drive for common document types — .doc, .xlsx, .pdf — hides the originals, and creates new shortcut files with identical filenames. From the user’s perspective, the drive looks completely normal. That’s the trap.

Once the shortcut executes, CryptoBandits malware drops obfuscated JavaScript payloads into C:\Users\Public\Documents and establishes persistence through scheduled tasks. One task keeps the worm alive by watching for newly inserted USB drives and spreading to them automatically. Another runs the stealer component continuously in the background. This maps directly to what MITRE ATT&CK classifies as replication through removable media — but the downstream consequences here are specifically financial.

What’s particularly worth emphasising is where this infection typically happens: before any wallet software is even open. The compromised moment is a shared USB drive in an office, a device borrowed from a colleague, an old removable-media habit that nobody bothered to update. By the time a user opens their MetaMask extension or prepares a treasury transfer, the machine is already working against them.

The Clipboard Is the Real Target

Once CryptoBandits malware establishes a foothold, its most operationally damaging feature kicks in: a continuous clipboard monitoring loop running roughly every 500 milliseconds. That’s twice per second, faster than most users paste anything, and it’s watching for very specific content.

Microsoft’s analysis found the malware scans clipboard contents for 12- and 24-word BIP39 seed phrases, Bitcoin WIF private keys, Ethereum private keys, and a wide range of cryptocurrency wallet addresses. The behaviour splits into two categories depending on what it finds.

If CryptoBandits malware detects a seed phrase or private key, it saves the value locally and exfiltrates it through Tor to attacker-controlled infrastructure. That’s a full wallet compromise — whoever receives that seed phrase owns every address derived from it, on every chain, permanently.

If it finds a wallet address — the kind you’d copy when preparing to send funds — it replaces that address with one controlled by the attacker. And here’s where the implementation gets genuinely sophisticated: Microsoft noted the malware attempts to make the swap visually plausible. For some Bitcoin, Tron, and Monero addresses, it matches the opening characters of the original. For Bech32-format Bitcoin addresses, it may only change the final character. The goal is to slip past the casual ‘first and last four characters’ check that many users actually perform.

This isn’t a new concept. Microsoft’s own 2022 research on cryware and hot wallets described ‘clipping and switching’ as a core wallet-theft technique — intercepting address data before a transaction is signed. What CryptoBandits malware adds to that established playbook is the USB propagation layer and Tor-based command-and-control, turning a known attack pattern into something with far greater reach and deniability.

Why Self-Custody Makes the Stakes Higher

There’s a structural reason CryptoBandits malware lands harder on self-custody users than on people holding assets on exchanges. When you custody your own crypto, the clipboard is part of the transaction workflow — it’s how seed phrases get typed during recovery, how addresses get pasted when sending funds, how wallet details move from one application to another. There’s no intermediary to catch a swapped address. There’s no fraud team to call when funds leave to an unrecognised destination.

MetaMask’s own support documentation — used by tens of millions of self-custody users globally — treats seed phrases and private keys as absolute wallet-control secrets and explicitly instructs users to verify recipient addresses before confirming any send. CryptoBandits malware attacks precisely those two moments: the secret that authorises access, and the address that directs funds. It’s targeting the exact checkpoints that responsible custody guidance tells you to protect.

Hardware wallets are often cited as the solution to endpoint threats, and in some ways they are — the private key never leaves the device. But CryptoBandits malware exposes something that hardware wallet manufacturers don’t always advertise loudly: a hardware wallet doesn’t sanitise the address you’re sending to. If you copy a recipient address on an infected Windows machine, and that address gets swapped before you paste it into your hardware wallet’s confirmation screen, you’ll be asked to confirm a transaction to an address you never intended. Most users, seeing the first few characters match what they expect, will approve it.

This isn’t a criticism of hardware wallets — it’s a reminder that the security model depends on the entire workflow being clean, not just the signing step.

What Microsoft’s Report Leaves Unanswered

Microsoft’s disclosure is operationally useful but notably incomplete in a few areas. The company didn’t provide any estimates of total funds stolen or the number of systems confirmed infected. There’s no attribution — no threat actor group named, no geographic origin suggested, no indication of whether this is a financially motivated criminal operation or something more targeted.

That absence of scale data makes it difficult to assess how widespread CryptoBandits malware actually is right now. It’s been active since February 2026 by Microsoft’s own timeline, which means it had several months of runway before this public disclosure. The Tor-routed command-and-control infrastructure specifically complicates traffic analysis and attribution — which is almost certainly why it was chosen.

For organisations managing crypto treasury operations or any team where multiple people handle wallet workflows on shared or general-purpose machines, the operational guidance coming out of this report is practical regardless of scale uncertainty. USB drives should be treated as untrusted media on any machine that participates in wallet workflows. Signing workstations should be isolated from general document handling. Clipboard-aware security tooling — or simply the habit of verifying addresses character by character on a separate trusted display — matters more than most custody checklists currently reflect.

The broader trend here is one the industry keeps circling back to: as on-chain security has hardened through better smart contract auditing and more cautious DeFi design, attackers have shifted their focus to the human layer — the endpoint, the clipboard, the moment between copying and pasting. CryptoBandits malware is a clean example of that shift, and the USB propagation vector suggests its authors specifically want to reach machines that might otherwise never touch a phishing link or a malicious download. In that sense, it’s less a technical novelty and more a reminder that the attack surface for crypto theft extends well beyond the blockchain itself.

Source: CryptoSlate

Frequently Asked Questions