If you thought USB drives were a relic of a less sophisticated threat era, think again. On June 17, 2026, Microsoft's Threat Intelligence team dropped a stark warning that should be on every IT professional's radar: a new self-propagating malware called Crypto Clipper — officially classified as Trojan:Win32/CryptoBandits.A — has been silently targeting Windows users and draining cryptocurrency wallets since at least February 2026. What makes this threat particularly alarming isn't just what it steals — it's how deceptively lightweight, persistent, and difficult to detect it is.

Here's everything IT teams need to understand about this threat, and precisely what to do about it right now.

What Is Crypto Clipper (CryptoBandits)?

Microsoft has detected new self-propagating malware that spreads through USB drives in search of cryptocurrency credentials. The company named the worm Crypto Clipper because it monitors the contents of device clipboards for patterns consistent with wallet addresses or seed phrases.

But calling it a simple "clipper" undersells the danger.

Instead of relying on traditional infrastructure, it deploys a portable Tor client, routes traffic through a local SOCKS5 proxy, and blends data theft with remote code execution, turning a financially motivated stealer into a lightweight backdoor.

Microsoft disclosed the threat on June 17, 2026, even though the campaign had been running quietly since February.

That four-month head start means some environments may already be compromised without any visible indicators.

How the Infection Spreads: The USB Attack Chain

The infection vector is deceptively simple — a physical USB drive.

Infection occurs when victims connect a compromised USB device to their computer. Hidden within the drive is a weaponized shortcut file bearing the ".lnk" extension. User interaction with this file triggers the installation of a self-propagating worm.

Once the victim clicks what appears to be a harmless file shortcut, the damage begins in earnest.

The worm component activates and drops two malicious JavaScript files into a subfolder under the public documents directory. It also creates scheduled tasks to ensure it keeps running even after a restart.

The self-replication mechanism is particularly clever.

The malware systematically scans the removable media for legitimate documents including Word files, Excel spreadsheets, and PDF documents. It then substitutes these files with identically-named shortcut files containing the malicious payload. This infected drive subsequently spreads the threat to every subsequent system it contacts.

To further cover its tracks,

the malware scans the infected USB drive and names the .lnk files with similar names

to the legitimate files it replaces — making manual detection nearly impossible for an untrained eye.

What Crypto Clipper Actually Does Once Inside

Once embedded in a system, CryptoBandits operates across two primary attack modes: active credential theft and persistent backdoor access.

Clipboard Hijacking and Wallet Theft

The wallet-stealing component monitors Windows' clipboard — the hidden temporary memory used for copy-and-paste operations — roughly every 500 milliseconds.

That's twice a second, every second.

The biggest risk is wallet address replacement. If a victim copies a cryptocurrency address before sending funds, the clipper can silently replace it with an attacker-controlled address, causing the transfer to go to the wrong wallet.

Crypto Clipper also monitors clipboard contents for patterns consistent with standardized 12- or 24-word seed phrases. When found, it uploads them, along with screenshots, to the attacker's server.

The malware is not selective about which coins it targets.

The malware targets multiple cryptocurrency types. For Bitcoin, it handles legacy, P2SH, Taproot, and Bech32 addresses.

Persistent Backdoor and Remote Execution

Beyond theft, this malware opens the door to far more dangerous follow-on attacks.

Beyond immediate theft, the backdoor allows the attacker to execute additional code later, opening the door to ransomware deployments or follow-on intrusions.

After registration with the command-and-control server, the malware enters a continuous loop, polling for instructions and monitoring the clipboard roughly every 500 milliseconds, extracting seed phrases and private keys that match wallet-related patterns.

All stolen data is transmitted anonymously.

Both the credentials and the screenshots are then sent to the attacker through Tor, a network protocol that provides anonymous routing by sending traffic through redundant nodes so logs can't capture both the sending and receiving IP addresses.

Why This Threat Is Harder to Detect Than Typical Malware

Traditional endpoint defences rely heavily on identifying known IP-based command-and-control (C2) infrastructure or flagging unusual installers. Crypto Clipper is specifically engineered to evade both.

As Microsoft noted, "The execution of this clipper is notable because it does not depend on a traditional installer or exposed IP-based C2 infrastructure."

The use of a bundled Tor client, scheduled tasks for persistence, and worm-like USB propagation makes the campaign particularly difficult to detect and disrupt.

For defenders, the strongest signals are behavioural: script interpreters spawning suspicious child processes, localhost:9050 proxy usage, screen-capture commands in PowerShell, and signs of clipboard inspection or crypto-address replacement.

The good news? Microsoft's own tools can catch it.

Microsoft Defender for Endpoint detects multiple components of this threat, such as suspicious JavaScript processes and possible data exfiltration using Curl. Additionally, Microsoft Defender Antivirus detects this crypto clipper as Trojan:Win32/CryptoBandits.A.

Binance also separately warned its own users about the campaign

, signalling that awareness is spreading across the industry.

Who Is Most at Risk?

While any Windows user is technically a potential victim, certain profiles face elevated exposure:

Admins should block .lnk execution from removable drives where possible. They should also disable AutoRun and AutoPlay for removable media, especially on systems used by finance teams, cryptocurrency traders, developers, and employees handling sensitive wallets.

Practical Tips: What IT Teams Should Do Right Now

The defences here are concrete and actionable. Don't wait for a confirmed breach — implement these steps today.

1. Disable AutoRun and AutoPlay for all removable media

Microsoft advises disabling autorun and autoplay and blocking the execution of .lnk shortcut files from USB drives.

This single control can stop the initial infection vector cold.

2. Restrict Windows Script Host executables

Where business workflows do not need them, organisations should limit or monitor wscript.exe, cscript.exe, PowerShell screenshot behaviour, suspicious curl execution, and scheduled task creation from user-writable paths.

3. Deploy behaviour-based detection, not just signature scanning

Security teams should use indicators together with behaviour-based detection. File hashes and .onion domains can change, but the campaign's USB shortcut behaviour, scheduled tasks, Tor proxy use, and clipboard monitoring provide stronger hunting signals.

4. Enforce a strict USB device policy

Users should not plug in any USB drive whose origin is unknown into their system.

Organisations should enforce device control policies via Group Policy or endpoint management tools to whitelist only approved USB devices.

5. Ensure Microsoft Defender is fully updated and active

Microsoft Defender Antivirus detects this campaign as Trojan:Win32/CryptoBandits.A, Trojan:Win32/CryptoBandits.B, Trojan:JS/CryptoBandits.A, and Trojan:JS/CryptoBandits.B.

Ensure definitions are current and that real-time protection is enabled across all endpoints.

6. Train staff to verify wallet addresses manually

Always verify the full address. Since the clipper swaps copied addresses, check every character of a pasted address against the intended one — not just the first and last few. Sending a small test transaction first is a sound habit for large transfers.

7. Audit scheduled tasks and network proxy connections
Hunt for any scheduled tasks created from user-writable paths and flag any connections to localhost:9050, which is the default Tor SOCKS5 proxy port used by this malware.

The Bigger Picture: Financially Motivated Attacks Are Accelerating

Crypto Clipper doesn't exist in a vacuum. It reflects a broader and deeply concerning trend in the threat landscape.

Microsoft's Digital Defense Report revealed that over 52% of cyberattacks with known motivations are driven by extortion and ransomware.

Today's attackers are primarily opportunistic criminals seeking financial gain — not state-sponsored actors. In 80% of incidents, attackers aimed to steal data.

Crypto assets are the ideal target for this kind of opportunistic attacker: transactions are irreversible, pseudonymous, and instant. Once a seed phrase is stolen or a transaction redirected, recovery is virtually impossible. This makes prevention — not incident response — the only viable strategy.

Conclusion: Act Before the Drive Plugs In

Crypto Clipper is a sharp reminder that some of the most effective modern malware doesn't rely on zero-day exploits or nation-state sophistication. It relies on a USB port, a convincing filename, and a few moments of inattention. The attack surface is physical, the payload is stealthy, and the financial consequences are immediate and permanent.

The time to act is now. Audit your endpoint policies, restrict removable media execution, update your Defender definitions, and brief your finance and development teams today. Review Microsoft's full security advisory at the Microsoft Security Blog for the complete list of indicators of compromise (IOCs) and hunting queries you can deploy in Microsoft Defender for Endpoint immediately. Don't let a thumb drive become the most expensive piece of hardware in your organisation.