USB WORM SPREADS CRYPTO-STEALING MALWARE

The malware operates as a clipboard-stealing trojan with self-propagation capabilities, spreading through removable USB drives. When infected shortcut files (.lnk) are executed, the worm establishes hidden connections through Tor to exfiltrate cryptocurrency wallet credentials and clipboard contents. The attack targets users storing digital assets on infected systems or accessing wallets through web browsers. The self-spreading mechanism allows the malware to propagate to connected USB devices, creating a secondary infection vector for air-gapped systems. The use of Windows shortcut files exploits user trust in familiar file types. Combined with Tor routing, the infrastructure makes attribution and traffic analysis difficult for security researchers. Security researchers recommend disabling autorun features for USB devices, monitoring clipboard activity, and implementing application whitelisting. Users should avoid executing unfamiliar files from removable media and maintain offline backups of cryptocurrency wallet private keys.