Microsoft’s latest crypto malware research points to crypto wallets, one of several places a transaction can fail, as a key practical weakness in self-custody,

A compromised Windows machine can change the address a user copies, expose a seed phrase before a transfer is signed, or send screenshots and wallet context back to an attacker.

In a June 17 Security Blog report, Microsoft said the CryptoBandits malware, detected as “CryptoBandits.A”, had been active since February 2026 and has reached systems through malicious Windows shortcut files on USB storage devices.

The malware also steals wallet secrets, swaps copied addresses, and communicates with command-and-control infrastructure through Tor. Microsoft said it monitors the…