Technical Details of "CryptoBandits"

Microsoft has issued a warning regarding a sophisticated Windows-based "clipper" malware campaign, active since February 2026, that utilizes USB drives to spread like a worm. Identified by Microsoft Defender as Trojan:Win32/CryptoBandits, the malware is designed to hijack cryptocurrency transactions and harvest sensitive wallet credentials [Source: https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/].

Technical Details of "CryptoBandits"

The malware combines traditional clipboard hijacking with advanced evasion and exfiltration techniques to drain user wallets.

• Clipboard Hijacking: The malware polls the system clipboard every 500 milliseconds. If it detects a cryptocurrency wallet address (Bitcoin, Ethereum, Tron, Monero, etc.), it instantly replaces it with an attacker-controlled address that looks visually similar to the original [Source: https://thehackernews.com/2026/06/windows-clipper-malware-swaps-crypto.html].
• Credential Harvesting: It scans local files for 12 or 24-word BIP39 seed phrases, Ethereum private keys, and Bitcoin WIF keys. These are saved locally before being exfiltrated [Source: https://securityaffairs.com/193860/uncategorized/tor-based-clipper-malware-targets-wallet-seed-phrases.html].
• Tor-Anonymized Control: To avoid detection, the malware bundles a portable Tor client (renamed ugate.exe) to communicate with its Command and Control (C2) server via .onion hidden services [Source: https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/].
• Evasion: The malware automatically pauses all activity if it detects Task Manager or other monitoring tools running, allowing it to remain undetected for long periods [Source: https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files/].

Why and How It Spreads

The primary motive is the direct theft of liquid crypto assets. Its rapid spread is attributed to a "worm-like" propagation method:

1. USB Infection: When an infected computer detects a new USB drive, the malware copies itself to the drive and scans for documents (.doc, .xlsx, .pdf).
2. Social Engineering: It hides the original documents and replaces them with malicious .lnk (shortcut) files that use the same names and icons. When a user clicks the shortcut on a new computer, the malware executes [Source: https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/].

Malware Capabilities Summary

Recommended Mitigations

Microsoft recommends that users disable AutoRun/AutoPlay for removable media and block .lnk file execution from USB drives. Additionally, monitoring for Tor activity on local ports (specifically localhost:9050) can serve as a high-confidence indicator of an active infection [Source: https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/].