Microsoft Discovers USB-Borne Malware Targeting Crypto Wallets

Microsoft has detected malware that exploits vulnerabilities to steal cryptocurrencies from Windows users. The malware, termed a "crypto clipper," spreads through infected USB drives containing malicious shortcut files that execute upon connection.

This worm, recognized as Trojan:Win32/CryptoBandits, has been reported as emerging since February. It operates by monitoring the clipboard for sensitive information, including cryptocurrency wallet seed phrases and private keys. If a user attempts to transfer funds, the malware can substitute the recipient wallet address with one controlled by attackers, enhancing the risk of financial losses.

Once installed, the malware keeps an active presence on the infected device, regularly scanning the clipboard every 500 milliseconds for relevant data. It also captures screenshots periodically and sends this information to remote servers using the Tor network, which is known for providing anonymity.

In an effort to mitigate the risks associated with this malware, Microsoft recommends several precautionary measures, including:

• Disabling AutoRun for external media to prevent automatic execution of malicious files.
• Blocking the execution of .lnk files on USB media via group policy.
• Restricting script hosts like wscript.exe and cscript.exe.
• Regularly monitoring network activity for indicators of compromise associated with the malware.

Microsoft has made public a list of these indicators, which can help security professionals identify potential infections within their networks. As cyber threats targeting crypto wallets become increasingly sophisticated, the importance of user vigilance and proactive security measures cannot be understated.