New CryptoBandits Malware Uses USB Drives and Tor to Steal Crypto
Microsoft discovers CryptoBandits malware spreading via USB drives to steal cryptocurrency wallet addresses.
Microsoft Threat Intelligence identified a new Windows-based cryptocurrency clipper called CryptoBandits (Trojan:Win32/CryptoBandits.A) active since February 2026. The malware spreads through USB devices via malicious shortcut files, monitors clipboard activity to intercept cryptocurrency wallet addresses and seed phrases, and replaces them with attacker-controlled addresses before transactions. It uses a bundled Tor client routed through localhost:9050 to communicate with C2 servers via .onion endpoints while evading detection by disabling itself when Task Manager is running.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCryptoBandits highlights how physical media (USB drives) remains a highly effective malware delivery vector that many organizations underestimate, particularly when users are not trained to distrust removable devices from unknown sources. The malware's clipboard-hijacking technique is especially dangerous because victims have no visual indication that their intended wallet address has been silently swapped, meaning a transaction can be irrevocably lost before any alarm is raised. Its anti-forensic behavior — disabling itself when Task Manager is open — demonstrates deliberate evasion of amateur-level detection, underscoring the need for automated, always-on endpoint monitoring rather than manual inspection. The use of a bundled Tor client to reach .onion C2 servers makes traditional domain-based blocklists ineffective, requiring deeper network inspection controls. This attack chain succeeds primarily because users trust what they paste and do not verify wallet addresses independently before finalizing transactions.
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — CryptoBandits
- malware — Trojan:Win32/CryptoBandits.A