The operators behind the Sality botnet and malware used a “clipjacking tool“ to replace wallet addresses with ones they controlled, enabling the theft of thousands of dollars in crypto.

Federal law enforcement and CrowdStrike dismantled the Sality botnet after it stole $150000 in cryptocurrency through clipjacking tools

International law enforcement agencies and private partners seized Sality-linked infrastructure in the U.S. and Europe, while CrowdStrike helped dismantle the botnet’s peer-to-peer control channels. The operation disrupted more than two decades of activity tied to SALTY SPIDER and its use of Sality to spread EggJagger payloads in clipjacking attacks. #Sality #SALTYSPIDER #EggJagger #CrowdStrike #DOJ #FBI #DCIS

At AllSafeUs Research Labs, we continuously observe a cybersecurity landscape where the line between routine operations and critical security incidents has thinned dramatically. The rapid integration of new AI tools, interconnected devices, and automated systems constantly expands the attack surface, often outpacing security team responses. This past week's recap — highlighting Fortinet exploits, RedLine clipjacking, NTLM cracking, and AI-driven Copilot attacks — vividly illustrates this persistent challenge and the necessity for adaptive defense strategies.