CrowdStrike, authorities dismantle Sality crypto-stealing malware

CrowdStrike and federal law enforcement dismantled Sality, a Russia-based malware operation that quietly stole cryptocurrency for roughly eight years. The malware watched for copied bitcoin and Ethereum addresses and silently replaced them with the attacker's own, redirecting funds during transactions.

• Authorities isolated more than 15,000 infected machines as part of the takedown.
• The operation relied on clipboard-hijacking to reroute crypto payments.
• The action marks a coordinated public-private effort to disrupt a long-running crypto theft campaign.