Technical Details of "CryptoBandits"
Published 6/19/2026, 9:19:27 AM
Microsoft has issued a warning regarding a sophisticated Windows-based "clipper" malware campaign, active since February 2026, that utilizes USB drives to spread like a worm. Identified by Microsoft Defender as Trojan:Win32/CryptoBandits, the malware is designed to hijack cryptocurrency transactions and harvest sensitive wallet credentials [Source: https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/].
Technical Details of "CryptoBandits"
The malware combines traditional clipboard hijacking with advanced evasion and exfiltration techniques to drain user wallets.
- Clipboard Hijacking: The malware polls the system clipboard every 500 milliseconds. If it detects a cryptocurrency wallet address (Bitcoin, Ethereum, Tron, Monero, etc.), it instantly replaces it with an attacker-controlled address that looks visually similar to the original [Source: https://thehackernews.com/2026/06/windows-clipper-malware-swaps-crypto.html].
- Credential Harvesting: It scans local files for 12 or 24-word BIP39 seed phrases, Ethereum private keys, and Bitcoin WIF keys. These are saved locally before being exfiltrated [Source: https://securityaffairs.com/193860/uncategorized/tor-based-clipper-malware-targets-wallet-seed-phrases.html].
- Tor-Anonymized Control: To avoid detection, the malware bundles a portable Tor client (renamed
ugate.exe) to communicate with its Command and Control (C2) server via.onionhidden services [Source: https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/]. - Evasion: The malware automatically pauses all activity if it detects Task Manager or other monitoring tools running, allowing it to remain undetected for long periods [Source: https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files/].
Why and How It Spreads
The primary motive is the direct theft of liquid crypto assets. Its rapid spread is attributed to a "worm-like" propagation method:
- USB Infection: When an infected computer detects a new USB drive, the malware copies itself to the drive and scans for documents (
.doc,.xlsx,.pdf). - Social Engineering: It hides the original documents and replaces them with malicious .lnk (shortcut) files that use the same names and icons. When a user clicks the shortcut on a new computer, the malware executes [Source: https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/].
Malware Capabilities Summary
| Feature | Detail |
|---|---|
| Detection Names | Trojan:Win32/CryptoBandits.A/B, Trojan:JS/CryptoBandits.A/B |
| Primary Goal | Theft of crypto assets via address swapping and seed phrase harvesting |
| Propagation | USB-based worm using malicious .lnk shortcuts |
| C2 Infrastructure | Tor-based hidden services (.onion) |
| Persistence | Scheduled tasks and Windows Defender exclusions |
Recommended Mitigations
Microsoft recommends that users disable AutoRun/AutoPlay for removable media and block .lnk file execution from USB drives. Additionally, monitoring for Tor activity on local ports (specifically localhost:9050) can serve as a high-confidence indicator of an active infection [Source: https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/].