{
 "slug": "cryptobandits-usb-worm-clipper-tor-jun-2026",
 "title": "Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor",
 "url": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026",
 "json": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026.json",
 "status": "closed",
 "severity": "high",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "bitcoin",
  "ethereum",
  "tron"
 ],
 "method": "clipboard-hijacker",
 "product": "Windows users who open shortcut files from USB drives",
 "tags": [
  "bitcoin",
  "ethereum",
  "tron",
  "clipboard-hijacker",
  "windows",
  "clipper",
  "usb-worm",
  "lnk",
  "tor",
  "microsoft",
  "cryptobandits",
  "seed-phrase"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-06-17",
 "closedAt": "2026-06-18",
 "updatedAt": "2026-06-18T12:00:00Z",
 "summary": "Microsoft reported a Windows crypto clipper, detected as Trojan:Win32/CryptoBandits, active since February 2026 and spreading through malicious shortcut (.lnk) files on USB drives. It checks the clipboard every half second, replaces copied Bitcoin, Tron and Monero addresses with lookalikes that share the first characters, grabs copied 12/24-word seed phrases and private keys, takes screenshots, and talks to its servers over Tor. Always check the whole address on your wallet or device screen before sending. No loss total was published.",
 "timeline": [
  {
   "date": "2026-06-17",
   "title": "Microsoft Threat Intelligence details the Tor-based crypto clipper with worm-like USB spreading, active since February 2026.",
   "sourceUrl": "https://www.microsoft.com/en-us/security/blog/?p=148177"
  },
  {
   "date": "2026-06-18",
   "title": "BleepingComputer reports the USB worm clipper and its address-swap and seed-phrase theft.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files/"
  }
 ],
 "sources": [
  {
   "kind": "advisory",
   "title": "Crypto Clipper uses Tor and worm-like propagation for persistence and control",
   "url": "https://www.microsoft.com/en-us/security/blog/?p=148177",
   "publisher": "Microsoft Security",
   "date": "2026-06-17"
  },
  {
   "kind": "news",
   "title": "USB worm spreads crypto-stealing malware via Windows shortcut files",
   "url": "https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files/",
   "publisher": "BleepingComputer",
   "date": "2026-06-18"
  }
 ],
 "indicators": {
  "domains": [
   "cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad[.]onion",
   "gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad[.]onion",
   "facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd[.]onion"
  ],
  "addresses": []
 },
 "brief": "## Am I affected?\nYou may be affected if you opened a shortcut on a USB stick on Windows, files on the stick looked like shortcuts, and a pasted wallet address did not fully match what you copied. Microsoft Defender flags it as Trojan:Win32/CryptoBandits.\n\n## What to do now\nRun a full antivirus scan and clean or reinstall the PC. If you ever copied a seed phrase or private key on that PC, move funds to a new wallet created on a clean device. Check recent sends against the address you meant to use.\n\n## How to avoid this\nTurn off AutoRun for USB drives and do not open shortcuts from removable drives. Never copy seed phrases or private keys to the clipboard. Check the full receiving address on your hardware wallet screen before sending.",
 "notes": null,
 "agentBrief": "# Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor\n\n- Severity: High · Status: Still active (past)\n- Chains: Bitcoin, Ethereum, Tron · Method: Clipboard hijackers\n- Started: Jun 17, 2026 · Last update: Jun 18, 2026\n- Who/what: Windows users who open shortcut files from USB drives\n\nMicrosoft reported a Windows crypto clipper, detected as Trojan:Win32/CryptoBandits, active since February 2026 and spreading through malicious shortcut (.lnk) files on USB drives. It checks the clipboard every half second, replaces copied Bitcoin, Tron and Monero addresses with lookalikes that share the first characters, grabs copied 12/24-word seed phrases and private keys, takes screenshots, and talks to its servers over Tor. Always check the whole address on your wallet or device screen before sending. No loss total was published.\n\n## Am I affected?\nYou may be affected if you opened a shortcut on a USB stick on Windows, files on the stick looked like shortcuts, and a pasted wallet address did not fully match what you copied. Microsoft Defender flags it as Trojan:Win32/CryptoBandits.\n\n## What to do now\nRun a full antivirus scan and clean or reinstall the PC. If you ever copied a seed phrase or private key on that PC, move funds to a new wallet created on a clean device. Check recent sends against the address you meant to use.\n\n## How to avoid this\nTurn off AutoRun for USB drives and do not open shortcuts from removable drives. Never copy seed phrases or private keys to the clipboard. Check the full receiving address on your hardware wallet screen before sending.\n\n## Indicators (block these, never visit them)\n- Domain: cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad[.]onion\n- Domain: gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad[.]onion\n- Domain: facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd[.]onion\n\n## Sources\n- Crypto Clipper uses Tor and worm-like propagation for persistence and control (Microsoft Security, 2026-06-17): https://www.microsoft.com/en-us/security/blog/?p=148177\n- USB worm spreads crypto-stealing malware via Windows shortcut files (BleepingComputer, 2026-06-18): https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files/\n\nFull record: https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026 · JSON: https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}