CryptoBandits malware: USB shortcuts, clipboard theft and Tor control to steal crypto wallets

Microsoft warns that CryptoBandits.A is a new USB-propagation crypto malware used to compromise self-custody workflows before any on-chain transfer. The malware spreads via malicious Windows .lnk files on USB drives, turning shortcut execution into wallet-stealing execution. Once on a Windows endpoint, CryptoBandits malware uses continuous clipboard polling (about every 500 milliseconds) to detect BIP39 seed phrases (12/24 words), private keys, and cryptocurrency addresses. It can exfiltrate wallet secrets through Tor and can also swap copied recipient addresses with attacker-controlled ones, including address formats designed to evade quick visual checks (e.g., similar prefixes and modified trailing characters). Microsoft also says CryptoBandits.A drops obfuscated JavaScript payloads, sets persistence using scheduled tasks, and uses Tor-routed command-and-control (including localhost SOCKS5 proxy behavior). Microsoft did not provide theft totals or attribution, so the scale and victim exposure remain unclear. Practical implications for crypto traders and teams: wallet handling should be treated as an endpoint security problem. Address verification must be performed on a trusted device/display, seed phrases and recovery material should never touch networked general-purpose machines, and removable-media use around signing or treasury workstations should be tightly controlled. Overall, CryptoBandits malware highlights that the clipboard and copy/paste path remain a key attack surface for self-custody.