Windows users beware. There\u2019s a new threat making its way through email called ComboJack, and it\u2019s stealing cryptocurrency. It has been targeting computers in both Japan and the United States, making off with digital coins during transactions. The malware hides in the background, waiting for a user to send coins, at which time it steals the wallet address. Since the addresses are a long series of numbers and letters, most users simply copy and paste the address in transactions, which is when ComboJack puts itself to work. The malware was first uncovered by researches with Palo Alto Networks (PAN). ComboJack is a variation of another crypto thief called CryptoJack. When the wallet address is copied, it is replaced with the address of the hacker\u2019s wallet. Victims don\u2019t realize what has happened and, according to the platform managing the transaction, the transfer appears completely legitimate. ComboJack is the latest in a series of coin thieves. CryptoShuffler was the first instance of a wallet pickpocket last year, but it was centered only on legacy Bitcoin (BTC). ComboJack works to steal BTC, Ethereum, Monero, Litecoin, and a number of other digital assets. The easiest way to avoid an infection is to never open email attachments from untrusted sources. PAN issued a report detailing how the malware is promulgated. A user will receive an email regarding a lost passport. The email is accompanied by an attachment containing the virus cloaked as a scanned passport in PDF. Once the PDF file is opened, users find only a single line of text requesting that he or she open an embedded document. That secondary document contains the remote code to infiltrate a Windows security flaw. The remote code downloads a two-part file to the target machine. One part is a self-extracting executable, and the other contains password-protected components used in the creation and installation of ComboJack. A Windows tool built into the executable gives the thief system-level privileges, which it then uses to edit the computer\u2019s registry to keep running in the background. At half-second intervals, ComboJack will check the Windows clipboard looking for a wallet address. Hopefully by now most computer users know better than to open attachments from unknown or untrusted sources. If an email looks suspicious, it probably is, and should simply be deleted. Viruses attached to emails have been used since David L. Smith\u2019s \u2018Melissa\u2019 virus in 1999 caused $1.2 billion in damages and losses, and are continuously more sophisticated. Remember, it\u2019s highly unlikely that \u201cAunt Sally\u201d is going to send pictures of her parasailing trip, especially if you don\u2019t have an Aunt Sally.