securityalert

📊 The Threat Landscape
The Attack: Microsoft Threat Intelligence has identified a Windows-based cryptocurrency clipper and stealer campaign—dubbed "CryptoBandits"—that has been actively compromising users since February 2026.The Vector: The infection propagates via physical USB storage devices by hiding legitimate documents and replacing them with malicious Windows shortcut (.lnk) files that share the same names.The Mechanics: Upon execution, the malware deploys a worm to infect other connected removable drives and relies on Windows Script Host to launch a bundled Tor proxy, which it uses to communicate stealthily with a hidden command-and-control server.
🧱 What It Steals & How
Address Swapping: The clipper component continuously monitors the system clipboard, polling it approximately every 500 milliseconds. It silently replaces copied Bitcoin (BTC), Monero (XMR), and Tron (TRX) wallet addresses with attacker-controlled equivalents crafted to partially match the original characters.Seed Phrase Hunting: The stealer aggressively scans clipboard data to detect and extract 12-word or 24-word BIP39 recovery seed phrases, Bitcoin Wallet Import Format (WIF) private keys, and Ethereum private keys.Visual Reconnaissance: To gain further context on the victim's wallet balances and hardware setups, the malware captures clusters of five screenshots (spaced ten seconds apart) and asynchronously exfiltrates them via the Tor network.
Defensive Outlook: Because this malware also establishes a lightweight backdoor capable of remote code execution, Microsoft strongly advises disabling AutoRun and AutoPlay on all removable media. Users should restrict the execution of .lnk files from USB drives and monitor networks for unauthorized local Tor proxy activity.
$SYN
$BEL
$LAB
#SecurityAlert #Warning #BTC #Tron #XMRUSD

USB propagation: The physical weapon of the CryptoBandits malware to raid wallets.
Thinking that cryptocurrency hacks only happen online is a rookie mistake.
The poverty mindset underestimates physical threats and connects unverified USB drives to the computer that hosts their trading apps or browser extensions (MetaMask, Coinbase Wallet). Microsoft Threat Intelligence researchers have revealed that this new malware spreads like a computer worm by replacing legitimate files with malicious shortcuts carrying the .lnk extension. As soon as the victim clicks on the fake document, the worm installs in the background, starts taking screenshots of your balances, and scans your hard drive for files containing recovery phrases (Seed phrases).