Malware Profile: Trojan:Win32/CryptoBandits
Published 6/19/2026, 7:39:25 PM
Microsoft has issued a high-severity warning regarding a sophisticated USB-spreading malware campaign identified as Trojan:Win32/CryptoBandits. This malware, active since at least early 2026, is classified as a "Crypto Clipper" but distinguishes itself through its ability to propagate via physical drives and its transition into a lightweight backdoor for remote code execution [Source: https://www.microsoft.com/en-us/security/blog/2026/06/17/analysis-of-cryptobandits-usb-worm/].
Malware Profile: Trojan:Win32/CryptoBandits
The threat is considered critical because it combines automated financial theft with advanced persistence and evasion techniques.
| Feature | Details |
|---|---|
| Primary Vector | Malicious Windows Shortcut (.lnk) files on USB drives [Source: https://thehackernews.com/2026/06/microsoft-warns-of-usb-spreading-crypto.html] |
| Clipboard Hijacking | Polls system clipboard every 500ms to swap wallet addresses [Source: https://www.microsoft.com/en-us/security/blog/2026/06/17/analysis-of-cryptobandits-usb-worm/] |
| Data Theft Targets | 12/24-word seed phrases, ETH private keys, and Bitcoin WIF keys [Source: https://www.microsoft.com/en-us/security/blog/2026/06/17/analysis-of-cryptobandits-usb-worm/] |
| C2 Infrastructure | Uses a bundled Tor proxy (ugate.exe) for hidden communication [Source: https://arstechnica.com/information-technology/2026/06/new-usb-worm-targets-crypto-users-with-tor-backdoor/] |
| Evasion | Automatically terminates if Windows Task Manager is detected [Source: https://arstechnica.com/information-technology/2026/06/new-usb-worm-targets-crypto-users-with-tor-backdoor/] |
How the Threat Operates
- Infection & Propagation: When an infected USB is inserted, the malware hides legitimate files (PDFs, DOCs, XLSX) and replaces them with malicious shortcuts that look identical. Clicking these executes the malware while opening the original file to avoid suspicion [Source: https://thehackernews.com/2026/06/microsoft-warns-of-usb-spreading-crypto.html].
- Active Theft: The malware monitors the clipboard for Bitcoin, Monero, or Tron addresses. If a user copies an address to send funds, the malware replaces it with an attacker-controlled address in less than half a second [Source: https://www.microsoft.com/en-us/security/blog/2026/06/17/analysis-of-cryptobandits-usb-worm/].
- Surveillance: It takes five screenshots at 10-second intervals, likely to capture sensitive information displayed on screen during wallet setup or transactions [Source: https://www.microsoft.com/en-us/security/blog/2026/06/17/analysis-of-cryptobandits-usb-worm/].
- Backdoor Capability: Beyond theft, it includes an
EVALcommand that allows attackers to download and execute arbitrary JavaScript, effectively turning the infected PC into a remote-controlled bot [Source: https://www.coindesk.com/tech/2026/06/19/microsoft-security-alert-usb-malware-targets-crypto-wallets/].
Severity and Risk Scale
The threat is particularly serious for individual holders and organizations using "air-gapped" or offline systems, as the USB propagation method is specifically designed to jump across network gaps. Because it uses Tor-based communication, its command-and-control (C2) traffic is difficult to block using standard IP filtering [Source: https://arstechnica.com/information-technology/2026/06/new-usb-worm-targets-crypto-users-with-tor-backdoor/].
Recommended Mitigations
- Disable AutoRun/AutoPlay on all Windows machines to prevent automatic execution of USB files.
- Visual Verification: Always verify the first and last 5 characters of a wallet address after pasting it.
- Network Monitoring: Watch for unexpected traffic on Port 9050 (default Tor port), which may indicate the malware's communication proxy is active.
- File Integrity: Be wary of
.lnk(shortcut) files on removable media that should contain standard documents.
In summary, this is a high-severity threat that evolves from a simple "clipper" into a full system backdoor, making it one of the more dangerous malware strains targeting crypto users in 2026.