Microsoft uncovers USB worm cryptocurrency threat that hijacks clipboard and runs over Tor

USB worm cryptocurrency threat uncovered by Microsoft

Microsoft Threat Intelligence reports a self‑propagating USB worm cryptocurrency that spreads through removable drives, monitors the Windows clipboard for wallet addresses and seed phrases, then tunnels stolen data through a portable Tor client to mask its trail.

Propagation via USB sticks

The code activates when an infected drive is inserted, automatically copying itself to the host and establishing persistence.

“The malware watches the clipboard for wallet strings and relays them through a portable Tor client,” a Microsoft analyst said.

Early indicators suggest the campaign has been active since February 2026, with ↓ 15% of detections missed by conventional AV solutions.

Security firms, including Reuters and Bloomberg, advise users to disable autorun, scan USB media, and employ hardware wallets that do not expose private keys to the clipboard.

Words by: Kaelen Frost

Lead Cybersecurity Analyst