[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftU0S-zhJ98zlju3c9gGadunLGXoGrLSRLPQvzGdw2hs":3},{"article":4,"iocs":49,"watch_terms":56,"solutions":57,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"037f053a-8a8a-4616-af8d-08ce02e17739","New CryptoBandits Malware Uses USB Drives and Tor to Steal Crypto","new-cryptobandits-malware-uses-usb-drives-and-tor-to-steal-crypto-ef79a3","Microsoft researchers warn of a new dual-action cryptocurrency clipper (CryptoBandits Malware) spreading through USB devices to alter wallet addresses and steal crypto assets.","Microsoft Threat Intelligence identified a new Windows-based cryptocurrency clipper called CryptoBandits (Trojan:Win32\u002FCryptoBandits.A) active since February 2026. The malware spreads through USB devices via malicious shortcut files, monitors clipboard activity to intercept cryptocurrency wallet addresses and seed phrases, and replaces them with attacker-controlled addresses before transactions. It uses a bundled Tor client routed through localhost:9050 to communicate with C2 servers via .onion endpoints while evading detection by disabling itself when Task Manager is running.","Microsoft discovers CryptoBandits malware spreading via USB drives to steal cryptocurrency wallet addresses.","https:\u002F\u002Fhackread.com\u002Fcryptobandits-malware-usb-drives-tor-steal-crypto\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Fcryptobandits-malware-usb-drives-tor-steal-crypto.png","2026-06-23T12:02:35+00:00","2026-06-23T14:00:13.016579+00:00",8,[17,20,23],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Windows Defender","product",{"name":24,"type":25},"Tor","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,42,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":26,"icon":28,"name":29,"slug":30},{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,53],{"type":30,"value":51,"context":52},"CryptoBandits","Windows-based cryptocurrency clipper, detected as Trojan:Win32\u002FCryptoBandits.A",{"type":30,"value":54,"context":55},"Trojan:Win32\u002FCryptoBandits.A","Microsoft Defender detection signature for CryptoBandits malware",[18,21],{"controls":58,"vendors":134},[59,79,108],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[64,71],{"vendor_slug":65,"vendor_name":18,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":80,"name":81,"problem":82,"products":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":109,"name":110,"problem":111,"products":112},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[113,121,126],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":65,"vendor_name":18,"vendor_logo":66,"product_slug":122,"product_name":123,"url":124,"description":125},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",[135],{"slug":65,"name":18,"logo_path":66,"roles":136},[137],"reported_by",{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":157},"usb-spread-clipboard-hijacker-silently-redirects-crypto-transactions","USB-Spread Clipboard Hijacker Silently Redirects Crypto Transactions","CryptoBandits highlights how physical media (USB drives) remains a highly effective malware delivery vector that many organizations underestimate, particularly when users are not trained to distrust removable devices from unknown sources. The malware's clipboard-hijacking technique is especially dangerous because victims have no visual indication that their intended wallet address has been silently swapped, meaning a transaction can be irrevocably lost before any alarm is raised. Its anti-forensic behavior — disabling itself when Task Manager is open — demonstrates deliberate evasion of amateur-level detection, underscoring the need for automated, always-on endpoint monitoring rather than manual inspection. The use of a bundled Tor client to reach .onion C2 servers makes traditional domain-based blocklists ineffective, requiring deeper network inspection controls. This attack chain succeeds primarily because users trust what they paste and do not verify wallet addresses independently before finalizing transactions.",[143,144,145,146,147,148,149,150,151,152,153,154,155,156],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 8: Audit Log Management","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SC-18: Mobile Code","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-2: Event Logging","NIST SP 800-53 MP-7: Media Use","NIST SP 800-53 AC-19: Access Control for Mobile Devices","NIST CSF DE.CM-1: Network Communications Monitoring","NIST CSF PR.AT-1: Awareness and Training","ITIL: Problem Management — recurring removable media threat vectors","GDPR Article 32: Security of Processing (where crypto assets are held on behalf of data subjects)",{}]