USB worm spreads crypto-stealing malware via Windows shortcut files

A campaign active since at least February uses LNK shortcut files on USB drives to distribute malware that monitors the clipboard and replaces cryptocurrency wallet addresses with addresses controlled by the attacker. The malware also monitors seed phrases and private keys, captures screenshots, and uses the Tor network to conceal communications.