[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftdS22I8a2rFDJ9QAaBb2JqE4c-aH3OnhzRvutWYWdmg":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":29},"fe1362a5-287b-4a7a-85c4-1cfea3d3d529","USB worm spreads crypto-stealing malware via Windows shortcut files","usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files-b2572f","Threat actors targeting cryptocurrency wallets have been distributing clipboard-stealing malware with self-spreading capabilities and using the Tor network to conceal communication. [...]","Threat actors are distributing a USB worm that spreads clipboard-stealing malware using Windows shortcut files. The malware targets cryptocurrency wallet addresses, seed phrases, and private keys, replacing legitimate addresses with attacker-controlled ones. It also exfiltrates screenshots and communicates via the Tor network.","USB worm uses LNK files to spread crypto-stealing malware that targets wallet addresses and seed phrases.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fusb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F07\u002FCryptocurrency-bitcoin.jpg","2026-06-18T16:20:06+00:00","2026-06-18T18:00:18.649332+00:00",8,[17,20,22],{"name":18,"type":19},"Tor","technology",{"name":21,"type":19},"LNK files",{"name":23,"type":19},"BIP39 seed phrases","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":24,"icon":26,"name":27,"slug":28},null,"Malware","malware",[30,35,40,42],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":24,"icon":26,"name":27,"slug":28},{"category":43},{"id":44,"icon":26,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":50,"vendors":135},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":81,"name":82,"problem":83,"products":84},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"slug":110,"name":111,"problem":112,"products":113},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[114,122,127],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":123,"product_name":124,"url":125,"description":126},"netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",[136],{"slug":73,"name":74,"logo_path":75,"roles":137},[138],"reported_by",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":155},"usb-worm-hijacks-crypto-wallets-via-windows-shortcut-files","USB Worm Hijacks Crypto Wallets via Windows Shortcut Files","This attack exploits the tendency of users to trust and plug in USB devices without scrutiny, combined with default Windows configurations that auto-execute shortcut (.lnk) files. The malware silently monitors the clipboard, replacing copied cryptocurrency wallet addresses with attacker-controlled ones — a technique known as clipboard hijacking — meaning victims unknowingly send funds directly to attackers. It further exfiltrates screenshots and hides its command-and-control traffic over Tor, making detection extremely difficult. The combination of physical media as an infection vector and stealthy financial theft highlights how legacy attack methods remain highly effective when security hygiene is weak. Organizations and individuals handling cryptocurrency are at particular risk if endpoint controls and user awareness programs are not kept current.",[144,145,146,147,148,149,150,151,152,153,154],"CIS Control 10 – Malware Defenses","CIS Control 13 – Data Protection","CIS Control 6 – Access Control Management","NIST SP 800-53 SC-18 – Mobile Code","NIST SP 800-53 MP-7 – Media Use","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AC-19 – Access Control for Mobile Devices","NIST CSF DE.CM-1 – Network Monitoring","ISO\u002FIEC 27001 Annex A 8.7 – Protection Against Malware","ISO\u002FIEC 27001 Annex A 7.10 – Storage Media","GDPR Article 32 – Security of Processing (for orgs handling personal data on affected systems)",{}]