Microsoft flagged a clipboard hijacker this week that does not just swap your wallet address. It swaps it with one that looks almost identical.

Tracked since February 2026, the campaign spreads through USB drives. Malicious .lnk files disguised as documents deliver a worm and a script-based stealer. Microsoft Threat Intelligence posted the findings on June 17, calling it a mix of clipboard theft, address replacement, and Tor-routed communications.

Most crypto users have heard the standard advice. Check the first and last few characters before sending. CryptoBandits makes that advice useless.

The Part Nobody Flagged

For Bitcoin legacy addresses starting with “1,” the malware builds a replacement matching the first two characters. Same trick for P2SH addresses starting with “3.” Taproot addresses get matched on the last character instead. Bech32 addresses, same thing.

Tron addresses starting with “T” get a two-character match. Monero is the exception. One hardcoded replacement, no matching.

A user copying a BTC address beginning with “1A” would see a pasted address also beginning with “1A.” Quick visual check passes. Funds gone.

The clipper scans clipboard contents roughly every 500 milliseconds, according to Microsoft’s full analysis. Half a second. It watches for 12 and 24-word BIP39 seed phrases too, plus Ethereum and Bitcoin WIF private keys.

Five Screenshots, Ten Seconds Apart

When the malware grabs a seed phrase, it does not just exfiltrate the words. Takes five screenshots. Ten seconds between each one. Uploaded asynchronously through Tor.

Those screenshots give attackers wallet balances. Full context on what they are about to drain.

Someone like Jake, a freelance dev who takes payment in ETH between coding sessions, pastes an address from his contacts. First three characters match. He sends 0.8 ETH. Nothing arrives. By the time he checks, screenshots already hit the attacker’s .onion server hours before.

That Tor routing does more work than most coverage suggested. The stealer bundles a portable Tor binary renamed to ugate.exe, launches it hidden, routes everything through localhost on port 9050 as SOCKS5 proxy. No DNS visibility for defenders. Zero exposed IP infrastructure to go after.

A USB Drive Started Everything

Initial access is physical. Infected USB storage carries .lnk shortcuts. Plug the drive in, and the malware scans for .doc, .xlsx, .pdf files. Hides originals. Creates new .lnk files with the same names.

Users open what they think is a spreadsheet. They are executing a worm.

Microsoft confirmed the worm creates two indefinite scheduled tasks. One spreads itself to any fresh USB inserted after infection. Another runs the stealer nonstop. JavaScript payloads drop into C:\Users\Public\Documents under a random five-character folder name, per the company’s blog.

Defense evasion goes layers deep. All components encrypted, decrypted only at runtime. A Python script obfuscated with PyArmor and packaged via PyInstaller handles installation. Both JavaScript payloads carry dual-layer obfuscation. An anti-analysis check queries Win32_Process and kills execution if Task Manager is running.

Basic, but enough to slow manual triage.

The 500-millisecond polling cycle mentioned earlier applies to the C2 side too. After initial registration, CryptoBandits sends a GUID heartbeat continuously. Stolen seeds get tagged SEED. Private keys get PKEY. Address replacements fire a REPL notification back to the .onion server.

EVAL Changes the Category

Here is where this stops being a clipper. The C2 can return an EVAL command. When it does, arbitrary JScript executes on the victim machine at runtime.

That turns a crypto stealer into a backdoor.

In a post on X, Microsoft Threat Intelligence described the blend of data theft with remote code execution as turning “a financially motivated stealer into a lightweight backdoor.” The EVAL function means the operator can pivot from theft to full device control whenever they want.

Defender for Endpoint flags several components. Trojan:Win32/CryptoBandits.A and Trojan:JS/CryptoBandits.A are the primary detections. Microsoft’s own guidance says behavioral signals matter more here, though. Hunt for wscript.exe or cscript.exe spawning curl. Look at localhost:9050 traffic paired with scripting activity.

Their IOC list runs long. 15 SHA-256 hashes for the worm. Ten .onion C2 domains, including one starting with “facebookw” that blends into casual URL scanning pretty easy.

Disabling AutoRun for removable media is the simplest fix. Blocking .lnk execution from removable drives via Group Policy, another. Most environments are not hunting for script-to-network chains yet, and that address-matching trick on the clipboard side means the user’s own eyes cannot be trusted as a last line of defense anymore.