CrowdStrike and federal law enforcement have disrupted a Russia-based malware operation that targeted cryptocurrency transfers for eight years, according to CoinDesk. Known as Sality, the malware monitored copied Bitcoin and Ethereum wallet addresses, then secretly substituted addresses controlled by the attackers. The technique was designed to redirect payments when users pasted wallet details before completing a transaction. Authorities and CrowdStrike have isolated more than 15,000 infected machines as part of the operation. The disclosure highlights a security risk for users handling BTC and ETH transfers: malware operating on an infected device can interfere with wallet-address copying without visibly changing the intended transaction at an earlier stage. The action affects the infrastructure associated with the malware, while the supplied report does not provide details on the value of cryptocurrency allegedly stolen or on arrests. Bitcoin and Ethereum are among the crypto assets connected to the reported campaign.
