Microsoft identifies malware 'worm' that hijacks crypto wallets, spreads through USB drives

Malware that spreads via USB sticks has been infecting Windows personal computers and targeting crypto wallets since February, Microsoft said in a blog post.

The firm calls the malware a "crypto clipper", and its Defender Antivirus identifies it as Trojan:Win32/CryptoBandits.

The process starts with an infected USB drive containing a malicious shortcut, or link, file. In Windows, shortcut filenames end in ".lnk" and direct the operating system to open a specific program, folder or file stored elsewhere on your computer.

When a user plugs in that drive and clicks the shortcut, a type of malware known as a "worm" is installed onto the PC. Once installed, it does two things: it constantly runs the actual crypto wallet-stealing code and simultaneously waits for a new, clean USB to be plugged into that same PC.