USB worm spreads crypto-stealing malware via Windows shortcut files
USB worm uses LNK files to spread crypto-stealing malware that targets wallet addresses and seed phrases.
Threat actors are distributing a USB worm that spreads clipboard-stealing malware using Windows shortcut files. The malware targets cryptocurrency wallet addresses, seed phrases, and private keys, replacing legitimate addresses with attacker-controlled ones. It also exfiltrates screenshots and communicates via the Tor network.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThis attack exploits the tendency of users to trust and plug in USB devices without scrutiny, combined with default Windows configurations that auto-execute shortcut (.lnk) files. The malware silently monitors the clipboard, replacing copied cryptocurrency wallet addresses with attacker-controlled ones — a technique known as clipboard hijacking — meaning victims unknowingly send funds directly to attackers. It further exfiltrates screenshots and hides its command-and-control traffic over Tor, making detection extremely difficult. The combination of physical media as an infection vector and stealthy financial theft highlights how legacy attack methods remain highly effective when security hygiene is weak. Organizations and individuals handling cryptocurrency are at particular risk if endpoint controls and user awareness programs are not kept current.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.