Plugging in the USB immediately gets you infected; this attack chain is too dirty—clipboard hijacking + address replacement + worm propagation—the triple threat. You’d better check if your computer has any unfamiliar scheduled tasks.

GoPlusSecurity warns that active cryptocurrency clipboard hijackers from February 2026 onward, combined with clipboard theft, wallet address replacement, and worm propagation, can achieve long-term access and control over infected devices.
The attack is distributed via malicious USB, monitoring new USB devices and creating malicious shortcuts; placing double-obfuscated JavaScript payloads in c:\users\public\documents\ and setting up scheduled tasks; communicating with renamed Tor clients and .onion domains; monitoring clipboard for mnemonics and private keys and exfiltrating them, while also taking screenshots; supporting multiple wallet address formats for replacement, with replaced addresses similar to the original, making detection difficult.