This malware campaign uses USB drives with malicious Windows shortcut files (LNK) to infect systems. When a user opens a shortcut, the malware executes and stages additional payloads from a Tor hidden service. It scans local documents, hides originals, and replaces them with malicious shortcuts to maintain persistence and spread. The malware monitors the clipboard every 0.5 seconds for various cryptocurrency wallet formats and seed phrases, replacing them with attacker addresses to redirect funds. It also captures screenshots every 10 seconds and sends them to the attacker via Tor. The malware creates scheduled tasks to monitor USB device connections and self-propagates by copying itself and creating malicious shortcuts on new drives. It can execute remote JavaScript code delivered by the attacker. Detection is challenging as behavioral indicators (e.g., unusual process activity and Tor proxy connections) are more reliable than signatures.

The malware enables theft of cryptocurrency by intercepting and replacing wallet addresses and seed phrases copied to the clipboard, potentially resulting in direct financial loss. It also compromises user privacy by capturing screenshots and exfiltrating sensitive data over Tor. The worm-like propagation via USB drives increases infection spread risk across air-gapped or isolated systems. Remote code execution capability allows attackers to execute arbitrary code, increasing the potential impact beyond data theft.

No official patch or fix is available for this malware. Mitigation focuses on user awareness to avoid opening unknown or suspicious shortcut files from USB drives. Monitoring for behavioral indicators such as unexpected launches of wscript.exe, cscript.exe, curl, PowerShell, and cmd.exe, as well as Tor proxy activity (e.g., connections to localhost:9050), can help detect infections. Restricting or disabling autorun features for removable media and scanning USB drives with updated antivirus solutions before use can reduce infection risk. Incident response should include isolating infected systems and removing malicious scheduled tasks and shortcut files.