- Microsoft has documented CryptoBandits.A, a Windows malware family active since February 2026 that spreads through malicious shortcut files on USB drives.
- The malware monitors the clipboard roughly every 500 milliseconds, looking for seed phrases, private keys, and wallet addresses that it can replace or steal.
- Microsoft’s guidance focuses on endpoint controls, such as disabling AutoRun, restricting shortcut execution, and watching for suspicious script and proxy activity.
Microsoft has published research on a Windows malware family that targets crypto wallet workflows by compromising the computer a user relies on for transactions. The company’s June 17 security blog post describes CryptoBandits.A, a clipboard-stealing threat that combines USB-based spread with Tor-routed communication. The findings put renewed attention on the device layer of self-custody, where a transfer can be altered before a hardware wallet ever gets involved.
What Happened
In its June 17 report, Microsoft said the malware, detected as CryptoBandits.A, has been active since February 2026. It reaches machines through malicious Windows shortcut files stored on USB storage devices. In the cases Microsoft examined, opening the shortcut stages a worm component on the system.
Once running, the worm searches attached USB drives for common document types, including .doc, .xlsx, and .pdf files. It hides the original files and creates new shortcuts that carry the same names, so a user who believes they are opening a document is instead launching the malicious payload. Microsoft said the malware then drops obfuscated JavaScript into C:\Users\Public\Documents and sets up scheduled tasks. One task is designed to spread the infection to newly inserted USB drives, while another carries out the theft activity.
The stealing component is built around the clipboard. After registering with its command-and-control server, the malware checks the clipboard roughly every 500 milliseconds. It looks for 12- or 24-word BIP39 seed phrases, Bitcoin WIF keys, Ethereum keys, and cryptocurrency addresses. Microsoft said seed phrases and private keys can be saved locally and sent out through Tor. When a copied address is detected, the malware can swap it for an attacker-controlled address.
To make the swapped addresses harder to spot, Microsoft said the malware sometimes mimics the leading characters of certain Bitcoin, Tron, and Monero addresses. For some Bech32-style Bitcoin addresses, it changes only the final character.
Why It Matters
The central point of Microsoft’s analysis is that a hardware wallet protects keys inside the device, but it does not verify what a computer places on the clipboard. If a user copies a deposit or withdrawal address on an infected machine, the destination may change before the transaction is signed. A user who checks only the first few characters may miss the substitution.
Seed phrase theft carries a different level of risk. A recovery phrase exposed through a compromised machine can allow access to a wallet long after the original infection is removed, and it does not depend on a single pending transfer. For this reason, Microsoft’s findings are relevant to individuals managing their own funds and to teams that approve treasury movements from workstations.
The report also shows how ordinary habits can create exposure. Sharing a USB drive, opening a file from removable media, or using a general-purpose computer for wallet tasks can all put a signing environment at risk before any wallet software is launched.
Market Context
Clipboard-based address replacement is not new. Microsoft has tracked this technique for years. In a 2022 report on cryware and hot wallets, the company described clipping and switching as methods used to intercept wallet data before a transaction is complete. CryptoBandits.A ties that known approach to removable-media spread and Tor-based command traffic, which Microsoft presents as a notable combination.
Wallet providers have long urged users to protect recovery phrases and private keys and to verify recipient addresses before sending funds. MetaMask’s support documentation, for example, treats seed phrases and private keys as control secrets and advises users to check recipient addresses before confirming a transfer. Microsoft’s findings suggest those instructions need to extend to the health of the device where the checks take place.
What to Watch Next
Microsoft’s report leaves several questions open. It does not disclose victim counts, confirmed theft totals, geographic distribution, or any named threat actor. Without those figures, the scale of financial harm cannot be measured from the report alone.
Microsoft’s mitigation advice centers on endpoint behavior. The company recommends disabling AutoRun and AutoPlay for removable media, blocking .lnk execution from removable drives through Group Policy where possible, and restricting unnecessary use of script hosts such as wscript.exe and cscript.exe. It also suggests reviewing Attack Surface Reduction rules for obfuscated scripts and suspicious child-process chains. Security teams are advised to investigate cases in which script engines launch tools such as curl, cmd.exe, or PowerShell, as well as local SOCKS5 proxy activity on localhost:9050 and PowerShell screen-capture activity on devices that handle financial workflows. Microsoft Defender includes detection for the malware under Trojan:Win32/CryptoBandits.A.
Readers should follow whether additional security vendors confirm these findings, whether Microsoft publishes further indicators of compromise, and whether wallet providers update guidance on clipboard protection and device hygiene. For now, the report’s clearest message is that self-custody security depends on the computer that prepares a transaction as much as on the wallet that signs it.
Source: original report
