Microsoft Detects CryptoBandits Malware Draining Crypto Wallets Since February 2026

According to Microsoft Threat Intelligence and Microsoft Defender Experts, the company discovered a new malware strain named Trojan: Win32/CryptoBandits.A on June 17 that has been infecting Windows users since February 2026 to drain cryptocurrency from their wallets.

The malware, known as a "clipper," works by monitoring a user's clipboard every 500 milliseconds. When it detects a cryptocurrency wallet address being copied, it silently replaces the legitimate address with one controlled by the attacker, causing victims to send funds directly to criminals instead. The malware also hunts for seed phrases and private keys that unlock crypto wallets.