- Microsoft uncovered a new malware campaign called CryptoBandits that has targeted Windows users since February 2026.
- The malware spreads through infected USB drives, monitors clipboard activity, and replaces cryptocurrency wallet addresses.
- The threat uses the Tor network to hide its communications while giving attackers remote access to infected systems.
Microsoft has revealed details about a new cryptocurrency-focused malware campaign called CryptoBandits. The operation has reportedly targeted Windows users since February 2026 and combines clipboard theft, USB-based spreading, and hidden communications through the Tor network.
According to Microsoft’s security researchers, the malware uses Windows Script Host and ActiveX-based components to launch a bundled Tor proxy and communicate with a hidden command-and-control server. The researchers explained that the malware repeatedly steals clipboard data, captures screenshots, and swaps cryptocurrency wallet addresses with attacker-controlled alternatives.
Microsoft researchers stated that the malware stands out because it does not rely on traditional installers or visible command-and-control servers. Instead, it launches a minute Tor client, transmits traffic via a local proxy (SOCKS5), and puts information theft alongside remote code deployment. The company noted that the operation turns a financially motivated stealer into what amounts to a lightweight backdoor.
Malware Spreads through USB Devices
The attack begins with a malicious Windows shortcut file (LNK) distributed through USB storage devices. While CryptoBandits uses USB drives as its primary vector, other campaigns have taken different approaches, such as a global operation that hijacked 250 websites, including a Harvard blog, to infect visitors with malware through compromised web pages.
When a victim opens the file, the malware first checks whether the computer already carries the infection. If it finds no previous infection, it downloads additional components from a remote server.
The malware then deploys a worm module alongside the clipper component. The LNK file searches the USB drive for common documents, including DOC, XLSX, and PDF files. It hides the legitimate files and creates shortcut files with identical names. Unsuspecting users believe they are opening their documents, but the shortcut silently launches the malware.
The worm also spreads the infection to other removable drives. It creates scheduled tasks to maintain persistence on the system and ensure both the worm and the clipper continue running after reboot.
Microsoft said the clipper relies on WScript and ActiveXObject to interact with Windows. The malware also checks active processes and shuts itself down if it detects Task Manager running, which helps it avoid detection.
Clipboard Theft and Remote Control
The final stage of the infection launches a renamed Tor executable in a hidden window. The malware creates a unique identifier for the victim and registers the infected device with the remote server.
After registration, the malware continuously contacts the command-and-control server for instructions while monitoring the clipboard approximately every 500 milliseconds.
Microsoft explained that the malware searches for cryptocurrency seed phrases, private keys, and wallet addresses. When victims copy wallet information during a transaction, the malware replaces the original address with one controlled by the attackers.
The company also reported that the malware sends screenshots through the Tor network. Researchers further stated that when the command server issues an “EVAL” instruction, the malware executes attacker-provided code directly on the infected system.
According to Microsoft’s findings, this capability gives attackers the ability to run additional commands after the initial compromise, making the malware more dangerous than a standard cryptocurrency stealer.
Microsoft Recommends Stronger Behavioral Monitoring
Microsoft advised security teams to prioritize behavioral detection methods instead of relying solely on static signatures. The company recommended monitoring PowerShell-based screen capture activity and watching for WScript, CScript, or similar scripting engines that launch programs such as cmd.exe, curl, PowerShell, or other unexpected executables.
Microsoft also urged organizations to disable AutoRun and AutoPlay features for removable media devices. The company recommended blocking shortcut file execution from USB drives through Group Policy Objects and limiting unnecessary access to wscript.exe and cscript.exe.
The researchers also advised defenders to monitor clipboard activity and screen-capture behavior, particularly on systems involved in cryptocurrency transactions or sensitive financial operations.
CryptoBandits shows how modern malware campaigns continue to combine older infection methods with newer evasion techniques. USB propagation, clipboard hijacking, Tor communications, and remote code execution now work together in a single operation, allowing attackers to steal digital assets while remaining hidden for long periods.
