Key Takeaways:
Microsoft Defender flagged a new USB malware that exposes bitcoin transactions to theft.The script steals 12 or 24-word seed phrases, threatening tron and monero wallet security.Microsoft next urges users to block shortcuts to stop the malware from spreading trough removable drives.The malware replaces files on removable media storage devices with shortcuts (.lnk files) that trigger the infection when executed, takes countermeasures against possible scanning and deletion by antivirus software, and uses anonymized Tor-powered communication to avoid detection.
At the same time, the malware propagates by copying itself to any USB drives inserted into an infected computer. It also runs a process that can execute various tasks, including changing the addresses copied by users into the clipboard of the infected device.
If it finds any, it assumes that the user is copying it to execute a transaction and changes it for a similar address, but that is under the control of the attacker to take hold of the funds sent by the users in the infected device.
“This malware family shows how lightweight, script-based stealers can deliver outsized impact when paired with anonymized communications and runtime tasking,” the Microsoft Defender team stressed.
To mitigate infections, the team recommends disabling autorun for content on all removable media and blocking the execution of shortcuts from removable drives, which have been identified as the main propagation vectors of the malware.
