Microsoft found malware that hijacks crypto wallets and spreads through USB sticks

The firm calls the malware a "crypto clipper", and its Defender Antivirus identifies it as Trojan:Win32/CryptoBandits.

The process starts with an infected USB drive containing a malicious shortcut, or link, file. In Windows, shortcut filenames end in ".lnk" and direct the operating system to open a specific program, folder or file stored elsewhere on your computer.

When a user plugs in that drive and clicks the shortcut, a type of malware known as a "worm" is installed onto the PC. Once installed, it does two things: it constantly runs the actual crypto wallet-stealing code and simultaneously waits for a new, clean USB to be plugged into that same PC.