Microsoft finds USB worm stealing cryptocurrency via Tor

🔑 Enhanced Key Takeaways

• •The malware, identified by Microsoft researchers as 'USB-Stealer-X', utilizes a sophisticated technique known as 'clipboard hijacking' to replace legitimate wallet addresses with attacker-controlled addresses in real-time.
• •Analysis reveals the malware leverages a legitimate, signed portable Tor binary to establish an encrypted SOCKS5 proxy connection, effectively hiding command-and-control (C2) traffic from standard firewall inspection.
• •The propagation mechanism exploits Windows AutoRun vulnerabilities and LNK file manipulation, allowing the worm to infect host systems immediately upon USB insertion without requiring user interaction.
• •Microsoft's telemetry indicates the campaign primarily targets users in Eastern Europe and Southeast Asia, with a specific focus on high-frequency cryptocurrency trading platforms.
• •The malware includes a persistence module that modifies the Windows Registry 'Run' keys, ensuring the malicious process restarts automatically after system reboots.

🛠️ Technical Deep Dive

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline