New CryptoBandits Malware Uses USB Drives and Tor to Steal Crypto
Microsoft Threat Intelligence and Microsoft Defender Experts have reportedly discovered a Windows-based cryptocurrency clipper, believed to be active since February 2026. Microsoft experts detected the malware as Trojan:Win32/CryptoBandits.A, (CryptoBandits malware), and probing further, they found that it monitors computer clipboards to steal financial data and give hackers remote control over infected systems.
How the Attack Spreads
The malware has a dual-component program, which means it combines a worm component for spreading with a stealer component for targeting financial data. The infection starts via USB flash drives containing malicious shortcut (.lnk) files. Clicking the shortcut launches a hidden worm instead of a document.
This worm hides the original files on the USB drive and creates matching malicious shortcuts to trick more users. To evade detection, it configures Windows Defender exclusions to bypass scanning on its setup folders. It then drops its main files (including two hidden JavaScript files) into a...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
