[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwbcaN33wXwTAoNy2n-YdZ7tNBWYP2T_c25S-xmkSfAg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"ad26247a-b6a9-402b-9f6a-11517599200a","usb-worm-hijacks-crypto-wallets-via-windows-shortcut-files","fe1362a5-287b-4a7a-85c4-1cfea3d3d529","USB Worm Hijacks Crypto Wallets via Windows Shortcut Files","This attack exploits the tendency of users to trust and plug in USB devices without scrutiny, combined with default Windows configurations that auto-execute shortcut (.lnk) files. The malware silently monitors the clipboard, replacing copied cryptocurrency wallet addresses with attacker-controlled ones — a technique known as clipboard hijacking — meaning victims unknowingly send funds directly to attackers. It further exfiltrates screenshots and hides its command-and-control traffic over Tor, making detection extremely difficult. The combination of physical media as an infection vector and stealthy financial theft highlights how legacy attack methods remain highly effective when security hygiene is weak. Organizations and individuals handling cryptocurrency are at particular risk if endpoint controls and user awareness programs are not kept current.","**Immediate actions:**\n- Disable Windows AutoRun\u002FAutoPlay for all removable media via Group Policy to prevent automatic execution of shortcut files.\n- Block or restrict USB storage device usage on endpoints using endpoint security tools or Group Policy Object (GPO) controls.\n- Deploy or update endpoint detection and response (EDR) tools to flag suspicious .lnk file execution and clipboard-manipulation behaviors.\n\n**Long-term improvements:**\n- Establish and enforce a removable media policy that prohibits use of unverified USB devices on corporate or personal cryptocurrency-handling systems.\n- Implement application allowlisting to prevent unauthorized executables dropped from USB devices from running.\n- Segregate cryptocurrency transaction systems onto hardened, isolated machines that have no general internet or USB access.\n\n**Detection measures:**\n- Monitor and alert on clipboard-access API calls from unexpected processes using behavioral analytics or EDR rules.\n- Log and inspect outbound Tor network traffic at the perimeter firewall, blocking Tor exit node IPs and .onion DNS resolution.\n- Conduct regular threat hunting for persistence mechanisms (e.g., scheduled tasks, registry run keys) commonly used by USB worm payloads.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 10 – Malware Defenses","CIS Control 13 – Data Protection","CIS Control 6 – Access Control Management","NIST SP 800-53 SC-18 – Mobile Code","NIST SP 800-53 MP-7 – Media Use","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AC-19 – Access Control for Mobile Devices","NIST CSF DE.CM-1 – Network Monitoring","ISO\u002FIEC 27001 Annex A 8.7 – Protection Against Malware","ISO\u002FIEC 27001 Annex A 7.10 – Storage Media","GDPR Article 32 – Security of Processing (for orgs handling personal data on affected systems)",{},"published","2026-06-18T18:21:07.749997+00:00","2026-06-18T18:21:07.648+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fusb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files\u002F","usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files-b2572f","USB worm spreads crypto-stealing malware via Windows shortcut files",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":39,"name":40,"slug":41,"description":42,"color":43},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":45,"name":46,"slug":47,"description":48,"color":49},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[52,56,60],{"slug":53,"name":54,"problem":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":57,"name":58,"problem":59},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":61,"name":62,"problem":63},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]