Threat actors are distributing a USB worm that propagates via Windows shortcut (.LNK) files and delivers clipboard-stealing malware aimed at cryptocurrency wallets. The malware intercepts clipboard content to replace wallet addresses with those controlled by attackers, enabling fund theft during transactions.
The worm exhibits self-spreading capabilities, replicating across connected drives and devices. It leverages the Tor network to obfuscate command-and-control communications, making detection and takedown more challenging. BleepingComputer reports the campaign is active but has not disclosed a specific CVE identifier or exact infection numbers.
Attackers rely on USB drives as the primary infection vector, exploiting Windows shortcut file execution upon drive insertion. The malware modifies clipboard data in real time, targeting both desktop and browser-based wallet interfaces. Indicators of compromise include unexpected .LNK files on removable media and anomalous Tor traffic from non-browser processes.
No official patch or vendor advisory has been released for this specific campaign. Users are advised to disable AutoRun for removable media, avoid connecting untrusted USB drives, and verify wallet addresses manually before confirming transactions. Security teams should monitor for unauthorized .LNK file creation and outbound Tor connections from unknown executables.
Attribution remains unclear, though the use of Tor and clipboard injection aligns with financially motivated cybercrime groups. The campaign underscores persistent risks in physical attack vectors, even as cloud-based threats dominate headlines.