A sophisticated, self-replicating malware campaign is actively draining cryptocurrency wallets by exploiting one of the most overlooked attack vectors in enterprise security: the humble USB drive. What makes this threat particularly alarming isn't just its target — digital assets — but the operational discipline baked into its design, from Tor-based command infrastructure to clipboard monitoring that fires every half second.
A Familiar Vector, Dangerously Refined
USB-borne malware is far from new territory, but this campaign demonstrates how legacy delivery mechanisms can be weaponized with modern operational security tradecraft. The initial infection begins when a victim opens what appears to be a standard Windows shortcut file — an LNK file — stored on a USB drive. That single click triggers the malware payload, which then reaches out to a .onion address to stage additional components over the Tor network, deliberately obscuring the attacker's infrastructure from traditional network monitoring tools.
The propagation mechanism is equally deliberate. Once installed, the malware conducts a local scan for document files. When found, legitimate files are hidden and replaced with malicious shortcuts bearing identical names — ensuring the payload executes the next time an unsuspecting user attempts to open what they believe is a familiar document. A scheduled task is then created to watch for newly connected USB storage devices, and when one is detected, the worm silently copies itself onto the removable drive and plants additional shortcut traps. The cycle then begins again on the next machine.
The Stealer Component: Precise, Persistent, and Patient
The clipboard-hijacking module at the heart of this campaign is a textbook example of a crypto clipper — but one with notable technical maturity. Before activating its data-theft routines, the malware checks whether Task Manager is running, a basic but effective anti-analysis technique designed to avoid triggering alerts during manual inspection. Communications with the command-and-control server are handled through a bundled Tor executable, routing all outbound traffic through the anonymizing network.
Every 500 milliseconds, the malware interrogates the system clipboard, searching for any of the following:
When a matching wallet address is detected on the clipboard, it is silently replaced with an attacker-controlled address. In a particularly cunning detail, the substituted addresses are selected to partially resemble the victim's original address — sharing opening characters or digits — reducing the likelihood that a quick visual check will expose the fraud before a transaction is confirmed.
The substituted wallet addresses are chosen to visually approximate the victim's own address, exploiting the natural human tendency to verify only the beginning and end of a long alphanumeric string.
Beyond clipboard manipulation, the malware captures five screenshots of the victim's display every ten seconds, exfiltrating them to the C2 server via curl. A remote code execution capability also exists — triggered by a C2 EVAL instruction — allowing operators to download and execute arbitrary JavaScript on infected machines, effectively transforming the clipper into a fully extensible remote access foothold.
Why Detection Is Harder Than It Looks
Security researchers have noted that signature-based detection alone is insufficient for identifying this threat. The malware's behaviors are designed to blend into normal Windows activity: shortcut files are commonplace, wscript.exe and cscript.exe are legitimate system components, and tools like curl, PowerShell, and cmd.exe appear in countless benign workflows. The use of Tor for C2 communications further complicates network-layer detection, since encrypted Tor traffic doesn't expose payload content to standard inspection tools.
The most reliable indicators of compromise are behavioral. Unexpected process trees spawning from script interpreters, anomalous curl invocations, and outbound connections to localhost:9050 — the default Tor proxy port — are the clearest signals that something is wrong. Organizations without behavioral analytics capabilities in their SIEM or EDR solutions are, in effect, flying blind against this type of threat.
What You Should Do
For Security Teams
- Implement USB device control policies that restrict or block the execution of files from removable media, particularly LNK and script files.
- Enable behavioral detection rules in your EDR for unusual parent-child process relationships involving
wscript.exe,cscript.exe, andcurl. - Monitor for Tor proxy activity, specifically connections to
localhost:9050, as well as unexpected.onionDNS resolution attempts. - Alert on scheduled task creation tied to removable device events, particularly if created by script engines rather than system processes.
- Consider clipboard protection solutions that can detect or block programmatic clipboard reads at high frequency.
For Individuals Handling Cryptocurrency
- Always verify the full wallet address — beginning, middle, and end — before confirming any transaction. Never rely on a quick glance at the first few characters.
- Avoid copying and pasting wallet addresses on systems where you cannot verify the security posture, including shared or unfamiliar machines.
- Treat unsolicited USB devices with extreme suspicion. A drive found in a parking lot or received unexpectedly in the mail is a known social engineering tactic.
- Use hardware wallets that display transaction details on a trusted, isolated screen, removing the clipboard from the transaction signing process entirely.
The convergence of worm-based self-propagation, Tor-obscured infrastructure, and precision cryptocurrency targeting signals a threat actor with both technical competence and a clear financial objective. As digital asset adoption grows, campaigns like this will only become more refined. The question for defenders isn't whether to take USB-borne threats seriously — it's whether their detection stack can actually see them when they arrive.
