# Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor

- Severity: High · Status: Still active (past)
- Chains: Bitcoin, Ethereum, Tron · Method: Clipboard hijackers
- Started: Jun 17, 2026 · Last update: Jun 18, 2026
- Who/what: Windows users who open shortcut files from USB drives

Microsoft reported a Windows crypto clipper, detected as Trojan:Win32/CryptoBandits, active since February 2026 and spreading through malicious shortcut (.lnk) files on USB drives. It checks the clipboard every half second, replaces copied Bitcoin, Tron and Monero addresses with lookalikes that share the first characters, grabs copied 12/24-word seed phrases and private keys, takes screenshots, and talks to its servers over Tor. Always check the whole address on your wallet or device screen before sending. No loss total was published.

## Am I affected?
You may be affected if you opened a shortcut on a USB stick on Windows, files on the stick looked like shortcuts, and a pasted wallet address did not fully match what you copied. Microsoft Defender flags it as Trojan:Win32/CryptoBandits.

## What to do now
Run a full antivirus scan and clean or reinstall the PC. If you ever copied a seed phrase or private key on that PC, move funds to a new wallet created on a clean device. Check recent sends against the address you meant to use.

## How to avoid this
Turn off AutoRun for USB drives and do not open shortcuts from removable drives. Never copy seed phrases or private keys to the clipboard. Check the full receiving address on your hardware wallet screen before sending.

## Indicators (block these, never visit them)
- Domain: cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad[.]onion
- Domain: gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad[.]onion
- Domain: facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd[.]onion

## Sources
- Crypto Clipper uses Tor and worm-like propagation for persistence and control (Microsoft Security, 2026-06-17): https://www.microsoft.com/en-us/security/blog/?p=148177
- USB worm spreads crypto-stealing malware via Windows shortcut files (BleepingComputer, 2026-06-18): https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files/

Full record: https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026 · JSON: https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.