USB worm spreads crypto-stealing malware via Windows shortcut files

A USB-spreading worm campaign active since at least February distributes a clipboard-stealing 'clipper' that replaces cryptocurrency wallet addresses, captures seed phrases, private keys and screenshots, and exfiltrates data via the Tor network (ugate.exe). Infection occurs through malicious .LNK files on removable drives and staged payloads from .onion addresses; the malware persists with scheduled tasks, replicates to newly connected USB devices, supports remote code execution, and exhibits behavioral IOCs including unexpected launches of wscript.exe/cscript.exe, curl, PowerShell, cmd.exe, and Tor proxy activity on localhost:9050.