Dismantling of the Sality botnet after eight years of clipjacking attack

An address almost identical to yours, except for one character. Since Wednesday, this sleight of hand no longer works. A botnet that has been trapping crypto users for eight years has just been dismantled by CrowdStrike and the American justice system. Her name, Sality. His age, 23, eight of which he spent hijacking Bitcoin and Ethereum addresses copied to his victims' clipboards. A method of disconcerting simplicity, which alone explains its longevity.

Sality trapped Bitcoin with a simple copy and paste

The process is called clipjacking, and its code name among the Sality operators was EggJagger. Its principle can be summed up in three words: monitor the clipboard of the infected machine, spot anything that looks like a Bitcoin or Ethereum address, then discreetly replace it with that of the attacker, without any window or alert betraying the substitution.

Nobody types a crypto address by hand, everyone copies and pastes it. It is precisely this habit that the malware has been exploiting for eight years. CrowdStrike puts the confirmed loot at at least 12.1 million rubles, around $150,000, from this payload alone. The unspent assets linked to Sality's portfolios had peaked much higher, around 147 million rubles at the start of 2025, a jackpot that no one ever came to claim.

A network without a leader, difficult to decapitate

Sality had been around since 2003, long before Bitcoin existed, and had survived several waves of cleanup without ever really disappearing.

Its secret weapon, no central server to enter. The infected machines communicated directly with each other, peer-to-peer, and the malware spread on its own by attaching itself to executable files exchanged on network shares and USB keys. No commander to arrest, no headquarters to search, not even an accommodation bill to bring up.

To overcome this, CrowdStrike and the authorities had to poison the network and redirect traffic to sinkholes. The operation, launched on August 31 and formally announced on September 1, mobilized the DOJ, the FBI, the American Defense Criminal Investigative Service, as well as police in Bulgaria, Hungary and Romania. It made it possible to isolate more than 15,000 infected machines spread across four countries.