The discovery of a USB-spreading malware campaign targeting cryptocurrency users demonstrates that removable media remains an effective attack channel, even in an era dominated by cloud applications, phishing emails, and browser-based threats.

The campaign uses malicious Windows shortcut files placed on USB storage devices to infect systems and spread automatically to additional removable drives. Once active, the malware deploys a cryptocurrency-focused information stealer capable of monitoring clipboard contents, replacing wallet addresses, searching for private keys and seed phrases, capturing screenshots, and executing additional code received from its command-and-control infrastructure.

The infection begins when a user opens a malicious Windows LNK shortcut stored on an infected USB drive. The shortcut appears to represent an ordinary document or file but instead launches the malware hidden on the removable device.

Windows shortcut files can contain commands, arguments, working directories, and references to scripts or executables. This makes them useful for legitimate application launching but also allows attackers to disguise malicious command execution behind familiar file names and icons.

The attack relies heavily on deception rather than a complex software vulnerability. The user believes they are opening a document, while the shortcut silently starts the infection chain.

After execution, the malware downloads additional components from infrastructure hosted through the Tor network. Tor helps conceal the location of the attacker’s command-and-control systems and makes infrastructure disruption and attribution more difficult.

The malware then scans the infected computer for document files. When suitable files are found, it hides the original documents and creates malicious shortcut files bearing the same names.

This technique increases the likelihood of repeated execution because users continue seeing what appear to be their normal documents. When they attempt to open one, the malware runs again instead of directly opening the original file.

The original content may still exist in a hidden location, allowing the attacker to preserve the appearance that the USB drive or directory contains legitimate data.

This is an effective social-engineering technique because it abuses normal user behaviour. Employees routinely open documents from shared drives, removable media, vendors, customers, field systems, or colleagues without carefully checking whether the file is a genuine document or a shortcut pretending to be one.

The worm also establishes persistence through a scheduled task that continuously monitors the computer for newly connected USB storage devices.

Whenever another removable drive is inserted, the malware copies itself onto that device and creates additional malicious shortcut files. The newly infected USB drive can then carry the malware to another computer, including systems that are not directly connected to the internet.

This self-propagating behaviour allows the campaign to move between personal devices, corporate workstations, shared computers, industrial environments, kiosks, and isolated networks.

USB propagation is particularly relevant in environments where removable media is used to transfer reports, software updates, diagnostic files, engineering data, or operational information between systems.

Organizations sometimes assume that an isolated or air-gapped system is protected simply because it cannot be reached directly from the internet. Removable media can quietly bridge that isolation, a role USB drives have performed with remarkable consistency despite decades of security warnings.

The information-stealing component is specifically designed to target cryptocurrency assets. It repeatedly inspects clipboard contents for wallet addresses, private keys, and recovery phrases.

The malware reportedly checks the clipboard approximately every half-second for 12-word and 24-word BIP39 seed phrases, Ethereum private keys, Bitcoin Wallet Import Format keys, and multiple types of Bitcoin, Tron, and Monero wallet addresses.

Seed phrases and private keys provide direct control over cryptocurrency wallets. Unlike an ordinary password, a stolen recovery phrase may allow an attacker to recreate the wallet on another device and transfer its funds without needing access to the original computer.

Once cryptocurrency has been transferred to an attacker-controlled wallet, recovering it can be extremely difficult. Blockchain transactions are generally irreversible, and the attacker may move the funds rapidly through multiple wallets, exchanges, mixers, or cross-chain services.

The malware also operates as a clipboard hijacker or clipper. When the victim copies a legitimate cryptocurrency wallet address, the malware replaces it with an address controlled by the attacker.

Because wallet addresses are long and difficult to memorize, users often verify only the first and last few characters before approving a transaction.

The attackers reportedly selected replacement addresses whose opening characters partially resemble the victim’s intended address. This increases the chance that a quick visual check will fail to reveal the substitution.

This technique does not need to break encryption, compromise the blockchain, or bypass the wallet’s authentication controls. It changes the destination before the user authorizes the transaction.

From the wallet application’s perspective, the user has approved a valid transaction to the address currently displayed. The security failure occurred earlier, when the clipboard content was silently modified.

The incident demonstrates why cryptocurrency users should verify the entire destination address through an independent channel, particularly for high-value transfers.

A small test transaction can reduce risk before sending a larger amount, though it does not prevent the malware from changing both transfers. Hardware wallets that display and require confirmation of the destination address on a trusted screen provide stronger protection when used correctly.

The malware also captures screenshots from infected systems. It reportedly takes five screenshots every ten seconds and transmits them to the attackers.

Screenshots may expose wallet applications, account balances, transaction details, private conversations, email content, authentication prompts, recovery information, corporate documents, and other sensitive material visible on the screen.

This capability expands the threat beyond cryptocurrency theft. A compromised business workstation may expose customer information, internal applications, financial records, login procedures, remote-access sessions, and confidential communications.

The malware checks whether Windows Task Manager is active before running certain components. This behaviour is likely intended to reduce the chance of detection while the user or administrator is examining running processes.

Malware frequently alters its behaviour when monitoring or analysis tools are present. It may delay execution, terminate itself, hide windows, suspend communications, or avoid launching visible processes.

This demonstrates why manually checking Task Manager is not a reliable method for proving that a system is clean. Malware can detect basic inspection activity and temporarily remain inactive.

The command-and-control communication uses a Tor executable identified as ugate.exe. Connections are routed through the local Tor proxy, typically using localhost on port 9050.

Tor traffic may be legitimate in certain environments, but unexpected Tor processes or local proxy connections on ordinary business workstations should receive immediate investigation.

The malware also uses the curl utility to transmit screenshots and communicate with external infrastructure.

Curl is a legitimate command-line transfer tool included with modern Windows systems and widely used by administrators and developers. Attackers increasingly abuse built-in tools because they are trusted, readily available, and less likely to be blocked solely on the basis of the executable name.

The presence of curl, PowerShell, Windows Script Host, or the command shell does not by itself prove malicious activity. Detection must consider the surrounding behaviour, including which process launched the tool, what arguments were supplied, what files were accessed, and which external destinations were contacted.

The malware also supports remote code execution through commands received from its command-and-control server.

An attacker can reportedly instruct the malware to download JavaScript content into a file and execute it on the infected system.

This allows the operators to extend the attack beyond the original cryptocurrency-stealing functionality. They may deploy updated payloads, install additional malware, steal broader categories of data, create persistence, or use the compromised device for further attacks.

Remote code execution effectively converts the infection into a flexible access platform rather than a fixed-purpose clipper.

The attackers can adapt the payload after gaining access, which means incident responders should not assume that every infected system experienced exactly the same activity.

For enterprises, the campaign is not merely a risk to employees who trade cryptocurrency. The same malware can establish persistence, execute code, capture screens, and spread between systems through USB devices.

An employee may connect an infected personal drive to a corporate computer, or use a company-issued drive on an infected home system. Contractors, service engineers, suppliers, and field personnel can also introduce removable media into protected environments.

Once the malware reaches a corporate endpoint, it may expose business information even when no cryptocurrency wallet is present.

Organizations should therefore maintain clear policies governing removable storage. Unapproved USB devices should be blocked or restricted, particularly on sensitive workstations, administrative systems, industrial networks, servers, and devices handling regulated data.

Where removable media is operationally necessary, organizations should use approved, encrypted, and centrally managed devices.

USB drives should be scanned before use, but scanning alone should not be regarded as complete protection. The GhostTree and similar incidents have already shown that file-system and shortcut behaviour can complicate conventional scanning, because apparently removable storage needed multiple ways to become inconvenient.

Organizations should disable or restrict automatic execution and ensure that Windows displays file extensions for known file types.

Users are more likely to identify a malicious shortcut when they can clearly see that a supposed document ends in .lnk rather than .pdf, .docx, .xlsx, or another expected extension.

However, attackers may use icons and filenames that make shortcuts visually convincing. Security awareness should teach employees to inspect the file type rather than relying only on appearance.

Users should be cautious when documents on a USB drive suddenly appear as shortcut files, particularly if original documents become hidden or inaccessible.

Organizations should consider blocking LNK files from removable drives where business requirements permit.

Application-control policies can restrict Windows Script Host, PowerShell, command shells, and unsigned executables from running directly from removable media or user-writable locations.

Windows Script Host processes such as wscript.exe and cscript.exe should be monitored when they execute scripts originating from USB drives, temporary directories, download folders, or user profile locations.

Suspicious child processes launched by shortcut files should generate alerts, particularly when they involve PowerShell, cmd.exe, curl.exe, script engines, scheduled-task utilities, or unknown binaries.

Scheduled-task creation should also be monitored. A task that continuously watches for newly attached removable devices or launches scripts from unusual directories is a strong behavioural indicator of this campaign.

Security teams should review systems for unexpected scheduled tasks, hidden files, shortcut files replacing ordinary documents, Tor components, and local connections to port 9050.

Unexpected instances of ugate.exe or other bundled Tor executables should be investigated.

Outbound network traffic to Tor infrastructure may be blocked where there is no legitimate business requirement. Security controls should also monitor for applications attempting to establish local SOCKS proxy connections.

DNS inspection alone may not identify all Tor activity because Tor clients can use built-in relay information and encrypted connections. Application-aware network visibility and endpoint telemetry are therefore important.

Endpoint detection systems should alert on unusual combinations of events rather than relying only on known malware signatures.

A sequence involving an LNK file executed from removable media, Windows Script Host, a scheduled task, hidden documents, curl activity, screenshot creation, and Tor communication is highly suspicious even if the individual file hashes are unknown.

This behaviour-based approach is particularly important because attackers can modify or repack malware to avoid simple signature detection.

Organizations should also monitor clipboard-related behaviour where endpoint tooling provides such visibility. Untrusted processes repeatedly accessing the clipboard or replacing copied values may indicate clipper malware.

Users handling cryptocurrency should verify wallet addresses on a separate trusted device or hardware wallet display before approving transfers.

Addresses should not be validated only by checking the first few characters. The complete address, or at least multiple separated sections, should be compared carefully.

High-value transactions should require additional approval procedures, particularly within organizations managing cryptocurrency assets, exchanges, custodial services, or blockchain-related operations.

Cryptocurrency businesses should consider address allowlisting, transaction-policy controls, multi-signature wallets, withdrawal delays, and independent verification through separate devices.

Seed phrases and private keys should never be stored in ordinary documents, screenshots, clipboard history, email drafts, cloud notes, or text files on general-purpose workstations.

Private keys should remain within hardware wallets or dedicated, secured key-management systems wherever possible.

Clipboard managers and synchronization features should also be reviewed because they may copy sensitive material between devices or retain it longer than intended.

If infection is suspected, the system should be disconnected from the network and removable drives should not be connected to other computers for inspection without controlled forensic procedures.

Every USB device recently attached to the affected system should be treated as potentially infected.

Users should not simply delete visible shortcut files and continue using the device. Hidden malware, scheduled tasks, altered documents, and additional payloads may remain.

Security teams should preserve relevant evidence, including shortcut files, scheduled-task definitions, running processes, command lines, network connections, USB history, hidden files, script contents, and recently downloaded payloads.

Cryptocurrency wallet credentials used or displayed on the affected system should be considered exposed.

Funds should be moved to a newly created wallet using a clean and trusted device. Reusing the same seed phrase or private key on another device does not remove the risk because the attacker may already possess it.

Passwords, browser sessions, API keys, email credentials, and other sensitive information visible on the compromised system should also be reviewed and rotated where necessary.

Credential changes must be performed from a separate trusted device. Changing a password or moving cryptocurrency while the information stealer remains active may simply provide the attacker with the new credentials or transaction details.

Where system integrity cannot be confidently restored, rebuilding the workstation from a known-good image is safer than attempting selective cleanup.

Connected removable drives should be securely erased and recreated after evidence collection. Important files should be recovered through controlled scanning and verification rather than copied blindly to another system.

Organizations should review whether the infected system accessed shared folders, remote desktops, administrative consoles, cloud services, financial platforms, or sensitive applications during the period of compromise.

Screenshot capture and remote code execution mean the impact may extend beyond the information directly stored on the endpoint.

The campaign also reinforces the need for layered security. Endpoint antivirus may detect some components, but network controls can identify Tor communication, suspicious downloads, unexpected outbound connections, and command-and-control behaviour.

Application control can restrict unapproved scripts and executables. Device control can limit USB access. Behavioural monitoring can identify scheduled tasks, hidden files, and suspicious process chains.

No single control is likely to stop every stage of the attack. Effective defence comes from overlapping controls that detect the campaign at different points.

The broader lesson is that removable media should not be regarded as passive storage. A USB drive can carry executable logic, deceptive shortcuts, hidden files, and self-propagating malware between otherwise separated environments.

The campaign succeeds by exploiting trust in familiar filenames, common Windows features, and ordinary user actions.

For customers, the key takeaway is that USB security requires more than scanning a drive once when it is connected. Organizations must control which devices are permitted, restrict what can execute from them, monitor suspicious shortcut and script activity, and investigate abnormal removable-media behaviour.

The cryptocurrency theft capability attracts attention, but the more important enterprise concern is the combination of self-propagation, persistence, screenshot collection, Tor communications, and remote code execution.

A malicious shortcut on a USB drive may look like a minor endpoint issue. In reality, it can create a path across multiple systems and security zones while stealing valuable information from every machine it reaches.

Attackers continue to use USB-based malware because organizations continue to rely on removable media and users continue to trust files that look familiar. Apparently, attaching a document icon to a shortcut remains enough social engineering to keep an entire attack technique alive.

Threat actors targeting cryptocurrency wallets have been distributing clipboard-stealing malware with self-spreading capabilities and using the Tor network to conceal communication. [...]

Source: USB worm spreads crypto-stealing malware via Windows shortcut files via Bleeping Computer — published 18 Jun 2026.