A USB worm campaign active since at least February targets cryptocurrency wallets by spreading clipper malware via LNK (Windows shortcut) files on USB drives. Once executed, the malware hides legitimate documents and replaces them with malicious shortcuts, creates a scheduled task to propagate to newly connected USB drives, and monitors the clipboard every half-second for seed phrases, private keys, and wallet addresses across Bitcoin, Ethereum, Tron, and Monero. Stolen addresses are swapped with attacker-controlled ones designed to visually resemble the originals. The malware also captures screenshots every ten seconds and exfiltrates data over Tor using curl. C2 communication is routed through a .onion address, and the malware supports remote code execution via JavaScript. Microsoft recommends behavioral detection — monitoring wscript.exe, cscript.exe, unexpected curl/PowerShell/cmd.exe launches, and connections to localhost:9050 — rather than signature-based approaches.
