Microsoft Exposes CryptoBandits: USB LNK Worm and Tor-Based Clipper Malware Campaign

Microsoft has disclosed details of a Windows-based cryptocurrency clipper campaign codenamed CryptoBandits that has targeted users since February 2026. The malware uses USB LNK files for propagation and Tor-based command-and-control (C2) communication to steal cryptocurrency wallet information.

According to the Microsoft Defender Security Research Team, the clipper relies on Windows Script Host and ActiveX-driven logic to launch a bundled Tor proxy and poll a hidden-service C2 server. It carries out high-frequency clipboard theft, screenshot exfiltration, and wallet-address substitution. The malware does not depend on a traditional installer or exposed IP-based C2 infrastructure; instead, it deploys a portable Tor client, routes traffic through a local SOCKS5 proxy, and blends data theft with remote code execution.

The attacks involve distributing a malicious Windows Shortcut (LNK) file via USB storage devices. Opening the LNK triggers a worm component that checks if the machine is already infected and fetches the payload from a remote server if not. A second module is the clipper that harvests and exfiltrates cryptocurrency wallet information. The LNK payload scans USB devices for common document types (DOC, XLSX, PDF), hides them, and creates new LNK files with the same names that link to the worm component.

The worm component ensures propagation to other uncompromised USB drives and deploys scheduled tasks for persistence. The clipper uses WScript and ActiveXObject to interact with the operating system and exits if Task Manager is running to evade detection. In the final stage, the malware launches a renamed Tor binary, generates a unique victim identifier, and registers it with the external server. It then enters a continuous loop, polling the C2 server for instructions while monitoring the clipboard every 500 milliseconds to extract seed phrases and private keys.

Microsoft recommends defenders prioritize behavioral detections over static signatures, specifically looking for PowerShell-based screen capture and the use of WScript, CScript, or related script engines for launching curl, cmd.exe, PowerShell, or unexpected executables. Other mitigations include disabling AutoRun/AutoPlay for all removable media, blocking LNK execution from removable drives via Group Policy Objects (GPOs), restricting unnecessary use of wscript.exe or cscript.exe, and reviewing clipboard-related and screen-capture behaviors on devices handling sensitive financial workflows.