BlockBeats News, September 2nd, CrowdStrike announced with the U.S. Department of Justice the takedown of the Sality peer-to-peer botnet, isolating over 15,000 infected devices globally. The network has been spreading since 2003, primarily deploying a clipboard hijacking tool named EggJagger over the past 8 years to steal funds from BTC and ETH transactions.

EggJagger monitors encrypted wallet addresses copied by victims and replaces them with an address controlled by the attacker, leading to the transfer of funds to the attacker. CrowdStrike estimates that this tool alone has stolen at least $150,000 worth of crypto assets; as most funds were not transferred, the related holdings' value peaked at around $1.35 million in January 2025.

The U.S. Department of Justice, FBI, and Defense Criminal Investigative Service have seized related domain names within the U.S., while Bulgarian, Hungarian, and Romanian authorities have shut down infrastructure in Europe. Currently, infected devices have been redirected to CrowdStrike-controlled command-and-control servers, but the original malware within the devices will remain active until manually removed.