CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation

Microsoft Defender researchers documented the CryptoBandits campaign in June 2026, a Windows targeting cryptocurrency theft operation active since at least February 2026 that combines worm-like propagation through USB removable media with a clipboard hijacker capable of silently redirecting transactions across six cryptocurrency address formats: Bitcoin legacy, P2SH, Taproot, Bech32, Tron, and Monero. The threat carries no geographic or sector filter and spreads opportunistically to any Windows host where an infected USB device is inserted, placing all organizations with employees who use removable storage at risk. Two design choices make this campaign distinctive: a bundled, renamed Tor client that provides fully autonomous .onion C2 routing without relying on victim-installed Tor software, and a multi-layered obfuscation stack using PyArmor protected Python scripts packaged via PyInstaller that significantly raises the bar for static analysis.

Initial access is physical: the worm scans USB storage for document files (.doc, .xlsx, .pdf), hides the originals by setting the system hidden attribute, and replaces them with double extension LNK shortcuts masquerading as the same documents. When the victim opens what appears to be a legitimate file, WScript or CScript executes the embedded JavaScript payload, which decrypts and drops a second-stage component into a staging subdirectory under the shared public documents folder, using five character naming for both the folder and the script file. Persistence is established via two indefinite scheduled tasks: one drives continued USB propagation to any newly mounted removable media, and the other ensures the clipboard stealing component re-executes on each trigger interval, surviving reboots and manual process kills. An anti analysis guard queries running processes and exits execution immediately if Task Manager is detected.

The core financial impact is delivered through two theft mechanisms operating in parallel. The clipboard hijacker polls at roughly 500-millisecond intervals, detects cryptocurrency address formats by pattern matching, and silently substitutes the copied address with an attacker controlled equivalent while preserving the visual format to prevent victim suspicion during transactions. When a mnemonic seed phrase is detected in the clipboard, the malware saves a local backup copy and exfiltrates it to the C2 domain immediately. Corroborating context is captured via a PowerShell screen capture routine that takes five screenshots at 10-second intervals, supporting manual validation of any stolen credentials. All exfiltration travels via curl through a local SOCKS5 proxy to .onion C2 domains, with the bundled Tor binary (renamed ugate.exe) handling onion routing entirely independently of external Tor infrastructure, making the C2 channel resistant to both DNS-based and IP-reputation blocking.