bleepingcomputer.com
Jun 19, 2026
USB worm spreads crypto-stealing malware via Windows shortcut files
AI-summarised brief · reviewed before publication
A USB worm is spreading crypto-stealing malware via Windows shortcut files, targeting cryptocurrency wallets since at least February. The malware monitors clipboard contents, replacing wallet addresses with ones controlled by the attacker, and captures screenshots. Infection occurs when a victim opens a malicious LNK file on a USB drive, triggering the malware to execute and spread to other connected devices. The malware uses the Tor network to conceal communication and can capture seed phrases and private keys. Microsoft has identified the infection process and provided indicators of compromise.
💡 Why It Matters
- · Crypto theft can be particularly devastating due to the irreversible nature of transactions.
- · Malware that can stealthily replace wallet addresses poses a significant threat to individual investors and the broader cryptocurrency market.
