Microsoft warns crypto-clipping malware via USB can steal Bitcoin and Ethereum wallet keys

Microsoft has warned of new Windows crypto malware that targets wallet information and spreads via USB drives, using malicious “.lnk” shortcut files as the infection vector. The activity has been described as involving “crypto clipper” behavior, where transfers are intercepted and wallet-related data is targeted ^{[1] [2] [3] [4]}.

Microsoft says the malware can harvest sensitive wallet material, including seed phrases and private keys for Bitcoin and Ethereum, by monitoring clipboard activity and modifying destinations when it detects wallet transfers. It is also described as combining data theft with remote code execution/backdoor-like functionality ^{[2] [3] [4]}.

The reports emphasize user protections such as avoiding unknown USB devices and safeguarding wallet credentials, reflecting Microsoft’s guidance around how the malware operates and what it attempts to steal ^{[1] [3]}.

Microsoft’s warning highlights a USB-based malware campaign on Windows that steals crypto wallet credentials and can hijack clipboard-driven transfers by swapping recipient addresses ^{[2] [3]}.