MalwarePublished 18 Jun 2026

USB worm spreads crypto-stealing malware via Windows shortcut files

Source Bleeping Computer

windows

Description

Threat actors targeting cryptocurrency wallets have been distributing clipboard-stealing malware with self-spreading capabilities and using the Tor network to conceal communication. [...]

Impact

The malware enables theft of cryptocurrency by intercepting and replacing wallet addresses and seed phrases copied to the clipboard, potentially resulting in direct financial loss. It also compromises user privacy by capturing screenshots and exfiltrating sensitive data over Tor. The worm-like propagation via USB drives increases infection spread risk across air-gapped or isolated systems. Remote code execution capability allows attackers to execute arbitrary code, increasing the potential impact beyond data theft.

Defensive guidance

Mitigation focuses on user awareness to avoid opening unknown or suspicious shortcut files from USB drives. Monitoring for behavioral indicators such as unexpected launches of wscript.exe, cscript.exe, curl, PowerShell, and cmd.exe, as well as Tor proxy activity (e.g., connections to localhost:9050), can help detect infections. Restricting or disabling autorun features for removable media and scanning USB drives with updated antivirus solutions before use can reduce infection risk. Incident response should include isolating infected systems and removing malicious scheduled tasks and shortcut files.

Summary

This malware campaign uses USB drives with malicious Windows shortcut files (LNK) to infect systems. When a user opens a shortcut, the malware executes and stages additional payloads from a Tor hidden service. It scans local documents, hides originals, and replaces them with malicious shortcuts to maintain persistence and spread. The malware monitors the clipboard every 0.5 seconds for various cryptocurrency wallet formats and seed phrases, replacing them with attacker addresses to redirect funds. It also captures screenshots every 10 seconds and sends them to the attacker via Tor. The malware creates scheduled tasks to monitor USB device connections and self-propagates by copying itself and creating malicious shortcuts on new drives. It can execute remote JavaScript code delivered by the attacker. Detection is challenging as behavioral indicators (e.g., unusual process activity and Tor proxy connections) are more reliable than signatures.

References

bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 Jun 2026, 16:21 UTC

References

Community reviews

Related threats