The cybersecurity landscape has just secured a major victory with the dismantling of the Sality network, a botnet of exceptional longevity. Active since 2003, well before the rise of cryptocurrencies, this malware managed to evolve to target digital assets by 2017. Thanks to unprecedented international cooperation involving the FBI, the U.S. Department of Justice, and European authorities, this complex infrastructure has been neutralized, putting an end to eight years of silent theft from Bitcoin and Ethereum users.
Sality’s striking power lay in a technique known as "clipjacking," dubbed "EggJagger" by its operators. This method exploited human automation: when a victim copied a wallet address to perform a transfer, the malware would instantly detect the character string and discreetly replace it with the attackers' own. This method, formidable in its simplicity, allowed for operation without triggering a single alert on the infected computer, thereby exploiting users' almost systematic trust in the "copy-paste" function.
Financially, CrowdStrike investigators have confirmed direct losses estimated at approximately $150,000. However, analysis of the wallets linked to the group's activity suggests the total loot could have reached much higher heights, with unspent balances peaking at over $1.6 million at the start of 2025. These largely untapped funds attest to the scale of this criminal operation, which infiltrated more than 15,000 machines across various countries.
Sality's prolonged survival was due to its decentralized architecture, operating on a robust peer-to-peer (P2P) model. In the absence of a central server, the network had no single point of failure, making any classic seizure attempt ineffective. To stop the spread, authorities had to resort to advanced "sinkholing" techniques, poisoning internal traffic to isolate infected machines. This operation highlights the resilience of modern botnets and the growing difficulty of dismantling leaderless networks.
Despite this success, the Sality case remains a wake-up call for the entire crypto community. Although this specific network has been neutralized, the threat of clipjacking persists through other active malware. In the era of digital finance, rigor remains the best protection: systematic double-checking of the destination address before every transaction remains the only reliable defense against schemes that capitalize on the most mundane daily habits.