Microsoft discovered a self-spreading USB worm active since February that monitors clipboards for crypto wallets and routes stolen data through Tor.
The malware program has been deployed across multiple sectors since April, helping to provide initial access sold to ransomware gangs.