USB Worm Spreads Crypto-Stealing Malware via Windows Shortcut Files

IntroductionThreat actors targeting cryptocurrency wallets have shifted to a self-spreading clipboard-stealing malware that communicates through the Tor network. Active since at least February, the campaign relies on USB-delivered LNK shortcut files to propagate a crypto-clipping agent that watches the clipboard, substitutes wallet addresses, and exfiltrates sensitive data. The operation also monitors for seed phrases and private keys, and can capture screenshots for later transfer over the Tor network.

Infection and Propagation Dynamics

Initial infection begins when a victim opens a Windows LNK shortcut from a USB drive, which triggers the embedded malware on the removable device.
Payloads are staged from a hidden onion-address infrastructure, giving the operators a remote foothold.
The malware conducts an on-machine scan for document files. If such files are found, it covertly hides the originals and replaces them with malicious shortcuts bearing the same names, causing the user to open the malicious shortcut when attempting to access documents.
A scheduled task is created to monitor for new USB connections. Each time a removable drive is connected, the worm copies itself to the device and generates additional malicious shortcuts to sustain propagation.

Data Theft Engine: What the Clip Stripper Targets

Clipboard monitoring cadence: the malware polls the clipboard every half second for sensitive crypto data.
Wallet data formats targeted:
12-word and 24-word BIP39 seed phrases
Ethereum private keys
Bitcoin keys and addresses (WIF, legacy, P2SH, Bech32, Taproot)
Tron wallet addresses
Monero wallet addresses
The attacker’s addresses are chosen to resemble legitimate user addresses at a glance, increasing the chance the victim won’t immediately notice fraudulent substitutions.

From Clipboard to Fraudulent Transfer

When a wallet address is detected in the clipboard, the malware automatically replaces it with an attacker-controlled address, enabling funds to be diverted if a user copies and pastes an address into a transaction form.
The tool operates in the background, attempting to stay under the radar by aligning its activity with common user actions and typical clipboard patterns.

Additional Capabilities: Screenshots and Remote Execution

Screen capture: the malware records five screenshots every ten seconds, which are prepared for exfiltration.
Exfiltration channel: captured data is sent to the command-and-control (C2) server via a curl-based workflow, leveraging the Tor network for obfuscated transmission.
Remote code execution: in a controlled scenario, the C2 can issue an EVAL instruction that triggers JavaScript execution on the infected host. The malware downloads a script (named cfile) and runs it, enabling dynamic payload updates or command execution.

Behavioral Indicators: How to Spot the Threat

Behavioral rather than signature-based detection: security researchers emphasize that the strongest telltale signs are actions and process patterns, not fixed binary signatures.
Process anomalies to monitor:
Unanticipated launches of wscript.exe and cscript.exe
Unexpected curl invocations, PowerShell calls, and cmd.exe activity
Unusual child processes that appear alongside standard system operations
Network and proxy signals:
Connections to localhost:9050 or other Tor proxy activity
General Tor network chatter and onion-address communication patterns

Operational Timeline and Evidence

The campaign’s propagation flow includes LNK-triggered execution, local document manipulation, USB-driven self-copying, and onion-based payload delivery.
The wallet-targeting component aligns potential replacement addresses to the victim’s input context, a tactical choice designed to lower user suspicion.
The threat actor relies on fast, repetitive clipboard checks, periodic screenshot captures, and encrypted communications channels to the C2.

Context and Research Notes

Security researchers observe that breaches of this kind often rely on layered deception—misleading file names, disguised shortcuts, and stealthy persistence mechanisms—to outpace basic defenses.
Independent analyses highlight the value of breach-and-attack simulations to stress-test SIEM and EDR rules, revealing where conventional detections may fall short and how behavioral analytics can improve visibility.

Security Research Takeaways: What This Means for Defenses (Non-Specific Observations)

Behavioral monitoring is crucial: focusing on unusual process lifecycles, nonstandard tool usage, and atypical network destinations can reveal this class of threat.
File-system tampering signals, such as spoofed shortcuts replacing legitimate documents, can act as early indicators of a compromise.
Tor-based C2 communications and localhost proxy activity are red flags that warrant deeper inspection of network and host telemetry.

Closing Perspective: A Snapshot of the Threat Landscape

This USB-based worm illustrates how crypto-theft campaigns increasingly combine self-spreading capabilities with credential and key theft.
The blend of clipboard manipulation, screen capture, and remote script execution demonstrates a multi-stage approach designed to maximize impact while complicating detection.
The campaign underscores the importance of multi-layered visibility across endpoint processes, clipboard activity, USB device handling, and network egress.

Additional Context: Related Trends and Observations

The broader threat environment continues to see crypto-wallet manipulation evolve with more aggressive propagation vectors and increasingly covert data exfiltration techniques.
Researchers note that disruptions to traditional detection methods—such as reliance on static indicators—accentuates the need for behavioral analytics and cross-layer monitoring in security architectures.

Closing Note: Breach Testing and Visibility Emphasis

The value of comprehensive breach and attack simulation exercises remains central to identifying gaps in detection and response capabilities, particularly for threats that blend local impersonation with remote command-and-control channels.

USB Worm Spreads Crypto-Stealing Malware via Windows Shortcut Files

Get the next deep dive in your inbox

See what launched this week

The weekly digest