{"id":560752,"date":"2026-09-08T15:35:04","date_gmt":"2026-09-08T14:35:04","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=560752"},"modified":"2026-09-08T12:18:13","modified_gmt":"2026-09-08T11:18:13","slug":"copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/","title":{"rendered":"Active crypto address &#8220;copy and paste attack&#8221; threatens users even after major malware cleanup cut off hackers"},"content":{"rendered":"<p>The Aug. 31 disruption of the Sality botnet cut off its operator's ability to deliver new malicious software to infected computers, while malware already on those devices remained active, according to <a href=\"https:\/\/www.crowdstrike.com\/en-us\/blog\/inside-sality-botnet-disruption-operation\/\">CrowdStrike's Sept. 1 report<\/a>. Users of infected machines still need to remove the installed malware, including a tool that swaps cryptocurrency addresses and can redirect payments.<\/p>\n<p>CrowdStrike said the botnet enabled payload distribution to more than 33,000 infected machines worldwide. The figure measures compromised computers; the number of users who lost cryptocurrency remains unspecified.<\/p>\n<p>The <a href=\"https:\/\/www.justice.gov\/usao-cdca\/pr\/sality-malware-disrupted-international-cyber-takedown\">Justice Department announced the multinational operation<\/a> on Sept. 1, 2026, following the action the previous day. U.S. authorities seized Sality-linked domains, while partners in Bulgaria, Hungary and Romania acted against additional domains.<\/p>\n<h2>How the payment risk survives<\/h2>\n<p>CrowdStrike identified EggJagger as Sality's primary payload over the preceding eight years. The tool watches the clipboard for cryptocurrency addresses and substitutes ones controlled by the operator, including when someone copies a Bitcoin or Ethereum address for a payment.<\/p>\n<p>The dangerous step is sending to the substituted address. A user can intend to pay the correct recipient yet paste a different destination into the payment form. The redirection takes effect if the user sends funds to that destination.<\/p>\n\n<div class=\"cs-article-embed\">\n    <a href=\"https:\/\/cryptoslate.com\/cryptobandits-malware-usb-wallet-theft\/\" class=\"cs-article-embed__link\">\n        <div class=\"cs-article-embed__body\">\n            <span class=\"cs-article-embed__related-reading\">Related Reading<\/span>\n            <h3 class=\"cs-article-embed__title\">CryptoBandits malware lets criminals use your USB drive to access crypto wallets &#8211; Microsoft warns<\/h3>\n        <\/div>\n        <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\">\n            <i class=\"fa-light fa-arrow-up-right\"><\/i>\n        <\/span>\n    <\/a>\n<\/div>\n\n<p>Address-swapping software already installed on a computer can keep operating after Sality's communications are cut off. Users with a confirmed infection therefore still need to have the malware removed from their devices.<\/p>\n<p><a href=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-1171420a-38be-4a2a-af30-e4e34c0f99e5.png\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-560753\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-1171420a-38be-4a2a-af30-e4e34c0f99e5.png\" alt=\"Sality disruption on Aug. 31, 2026 blocked new payload delivery, while installed EggJagger can swap copied payment addresses. The flow shows payment redirection if the user sends to the substituted address, followed by detection and malware removal.\" width=\"720\" height=\"1080\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-1171420a-38be-4a2a-af30-e4e34c0f99e5.png 1024w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-1171420a-38be-4a2a-af30-e4e34c0f99e5-200x300.png 200w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-1171420a-38be-4a2a-af30-e4e34c0f99e5-683x1024.png 683w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-1171420a-38be-4a2a-af30-e4e34c0f99e5-768x1152.png 768w\" sizes=\"(max-width: 720px) 100vw, 720px\" \/><\/a><\/p>\n<p>CrowdStrike describes Sality as a file infector: it attaches to executable files and spreads through network shares, removable drives and file sharing. Those infected files are a separate problem from the network connections disrupted by the operation.<\/p>\n<p>The disruption changed the lists of peers that infected machines use to communicate, isolating them from the operator and inserting defender-controlled servers known as sinkholes. CrowdStrike said isolated bots could no longer receive payload download instructions or direct transfers of malicious files. Partners also took down URLs hosting payloads.<\/p>\n<p>For network operators, CrowdStrike recommends checking network logs and device telemetry for UDP traffic to its lighthouse address, <code>188.166.101[.]148<\/code>. The company says a match indicates a Sality infection requiring remediation. Its technical report also provides YARA detection rules for scanning running processes.<\/p>\n\n<div class=\"cs-article-embed\">\n    <a href=\"https:\/\/cryptoslate.com\/firefox-crypto-wallet-malware-hid-behind-nine-sports-add-ons-turning-routine-updates-into-a-key-rotation-trap\/\" class=\"cs-article-embed__link\">\n        <div class=\"cs-article-embed__body\">\n            <span class=\"cs-article-embed__related-reading\">Related Reading<\/span>\n            <h3 class=\"cs-article-embed__title\">40 malicious Firefox add-ons targeted crypto wallets, and 9 began as sports-score tools<\/h3>\n        <\/div>\n        <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\">\n            <i class=\"fa-light fa-arrow-up-right\"><\/i>\n        <\/span>\n    <\/a>\n<\/div>\n\n<p>The Justice Department said the Shadowserver Foundation is working with internet service providers and computer security incident response teams to identify infections and help notify affected users and support remediation.<\/p>\n<p>For users of infected computers, remediation addresses the malware that can still replace a copied payment address. The botnet disruption alone leaves that local threat in place.<\/p>\n\n<div class=\"cs-article-embed\">\n    <a href=\"https:\/\/cryptoslate.com\/spot-the-crypto-scam-before-you-hit-send\/\" class=\"cs-article-embed__link\">\n        <div class=\"cs-article-embed__body\">\n            <span class=\"cs-article-embed__related-reading\">Related Reading<\/span>\n            <h3 class=\"cs-article-embed__title\">Spot the crypto scam before you hit send<\/h3>\n        <\/div>\n        <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\">\n            <i class=\"fa-light fa-arrow-up-right\"><\/i>\n        <\/span>\n    <\/a>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>CrowdStrike says the Aug. 31 disruption blocked new payload delivery while installed malware can still swap cryptocurrency payment addresses.<\/p>\n","protected":false},"author":1264,"featured_media":561000,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[76799,77968,60208],"tags":[81073,76769,79633,76128,72190,77433],"prediction_market_topic":[],"post_folder":[],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.9 (Yoast SEO v21.9.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Sality botnet disrupted, but crypto-stealing malware remains<\/title>\n<meta name=\"description\" content=\"The Sality botnet disruption blocked new payloads, CrowdStrike says, but installed crypto-address-swapping malware still needs removal.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Active crypto address &quot;copy and paste attack&quot; threatens users even after major malware cleanup cut off hackers\" \/>\n<meta property=\"og:description\" content=\"The Sality botnet disruption blocked new payloads, CrowdStrike says, but installed crypto-address-swapping malware still needs removal.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/\" \/>\n<meta property=\"og:site_name\" content=\"CryptoSlate\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-08T14:35:04+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-08T11:18:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/sality-crypto-address-swap.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Liam &#039;Akiba&#039; Wright\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@akibablade\" \/>\n<meta name=\"twitter:site\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Liam 'Akiba' Wright\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/\"},\"author\":{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/#person\",\"name\":\"Liam 'Akiba' Wright\",\"url\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/\"},\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/#authorimage\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-300x300.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-300x300.jpg\",\"caption\":\"Liam 'Akiba' Wright\"},\"jobTitle\":\"Editor-in-Chief\",\"description\":\"Liam \u201cAkiba\u201d Wright is CryptoSlate\u2019s Editor-in-Chief, reporter and podcast producer, focused on decentralized tech\u2019s positive impact.\",\"worksFor\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"sameAs\":[\"https:\/\/www.akiba.gg\",\"https:\/\/x.com\/akibablade\",\"https:\/\/www.linkedin.com\/in\/liamandrewwright\",\"https:\/\/muckrack.com\/liam-wright\"]},\"headline\":\"Active crypto address &#8220;copy and paste attack&#8221; threatens users even after major malware cleanup cut off hackers\",\"datePublished\":\"2026-09-08T14:35:04+00:00\",\"dateModified\":\"2026-09-08T14:35:04+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/\"},\"wordCount\":458,\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"keywords\":[\"Bitcoin\",\"BTC\",\"CrowdStrike\",\"ETH\",\"ethereum\",\"payments\"],\"articleSection\":[\"Crime\",\"Featured\",\"Payments\"],\"inLanguage\":\"en-US\",\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/\",\"url\":\"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/\",\"name\":\"Sality botnet disrupted, but crypto-stealing malware remains\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/#website\"},\"datePublished\":\"2026-09-08T14:35:04+00:00\",\"dateModified\":\"2026-09-08T14:35:04+00:00\",\"description\":\"The Sality botnet disruption blocked new payloads, CrowdStrike says, but installed crypto-address-swapping malware still needs removal.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptoslate.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Active crypto address &#8220;copy and paste attack&#8221; threatens users even after major malware cleanup cut off hackers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptoslate.com\/#website\",\"url\":\"https:\/\/cryptoslate.com\/\",\"name\":\"CryptoSlate\",\"description\":\"Cryptocurrency News and Real-time Coin Data\",\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"inLanguage\":\"en-US\"},{\"@type\":\"NewsMediaOrganization\",\"@id\":\"https:\/\/cryptoslate.com\/#organization\",\"name\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"width\":1000,\"height\":1000,\"caption\":\"CryptoSlate\"},\"image\":{\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/twitter.com\/cryptoslate\",\"https:\/\/www.instagram.com\/cryptoslate\",\"https:\/\/www.linkedin.com\/company\/cryptoslate\",\"https:\/\/www.youtube.com\/c\/cryptoslate\",\"https:\/\/t.me\/cryptoslatenews\",\"https:\/\/www.crunchbase.com\/organization\/cryptoslate\",\"https:\/\/iq.wiki\/wiki\/cryptoslate\",\"https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ\",\"https:\/\/muckrack.com\/media-outlet\/cryptoslate\",\"https:\/\/www.tiktok.com\/@cryptoslatenews\"],\"publishingPrinciples\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"ownershipFundingInfo\":\"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/\",\"correctionsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"ethicsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"foundingDate\":\"2017-08-04\",\"founder\":[{\"@type\":\"Person\",\"name\":\"Nate Whitehill\"},{\"@type\":\"Person\",\"name\":\"Matthew Blancarte\"}],\"contactPoint\":[{\"@type\":\"ContactPoint\",\"contactType\":\"customer support\",\"url\":\"https:\/\/cryptoslate.com\/contact\/\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"sales\",\"url\":\"https:\/\/cryptoslate.com\/contact\/?topic=advertising#contact-form\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"newsroom\",\"url\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"email\":\"tips@cryptoslate.com\",\"availableLanguage\":\"en-US\"}],\"masthead\":\"https:\/\/cryptoslate.com\/about\/#masthead\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/ea2b02b41a7478e18d903ca8eec4979e\",\"name\":\"Liam 'Akiba' Wright\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-150x150.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-150x150.jpg\",\"caption\":\"Liam 'Akiba' Wright\"},\"description\":\"Also known as \\\"Akiba,\\\" Liam Wright is the Editor-in-Chief at CryptoSlate and host of the SlateCast. He believes that together decentralized blockchain and AI technology have the potential to make widespread positive change.\",\"sameAs\":[\"https:\/\/www.akiba.gg\",\"https:\/\/www.instagram.com\/akibablade\",\"https:\/\/twitter.com\/akibablade\"],\"award\":[\"Most improved footballer - 1992\"],\"knowsAbout\":[\"Python\",\"Javascript\",\"PHP\",\"HTML\",\"Agentic Software\",\"Machine Learning\",\"2000s emo music\",\"Manchester United\"],\"knowsLanguage\":[\"English\",\"Spanish\"],\"url\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Sality botnet disrupted, but crypto-stealing malware remains","description":"The Sality botnet disruption blocked new payloads, CrowdStrike says, but installed crypto-address-swapping malware still needs removal.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/","og_locale":"en_US","og_type":"article","og_title":"Active crypto address \"copy and paste attack\" threatens users even after major malware cleanup cut off hackers","og_description":"The Sality botnet disruption blocked new payloads, CrowdStrike says, but installed crypto-address-swapping malware still needs removal.","og_url":"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/","og_site_name":"CryptoSlate","article_published_time":"2026-09-08T14:35:04+00:00","article_modified_time":"2026-09-08T11:18:13+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/sality-crypto-address-swap.jpg","type":"image\/jpeg"}],"author":"Liam 'Akiba' Wright","twitter_card":"summary_large_image","twitter_creator":"@akibablade","twitter_site":"@cryptoslate","twitter_misc":{"Written by":"Liam 'Akiba' Wright","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/#article","isPartOf":{"@id":"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/"},"author":{"@type":"Person","@id":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/#person","name":"Liam 'Akiba' Wright","url":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/"},"image":{"@type":"ImageObject","@id":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/#authorimage","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-300x300.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-300x300.jpg","caption":"Liam 'Akiba' Wright"},"jobTitle":"Editor-in-Chief","description":"Liam \u201cAkiba\u201d Wright is CryptoSlate\u2019s Editor-in-Chief, reporter and podcast producer, focused on decentralized tech\u2019s positive impact.","worksFor":{"@id":"https:\/\/cryptoslate.com\/#organization"},"sameAs":["https:\/\/www.akiba.gg","https:\/\/x.com\/akibablade","https:\/\/www.linkedin.com\/in\/liamandrewwright","https:\/\/muckrack.com\/liam-wright"]},"headline":"Active crypto address &#8220;copy and paste attack&#8221; threatens users even after major malware cleanup cut off hackers","datePublished":"2026-09-08T14:35:04+00:00","dateModified":"2026-09-08T14:35:04+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/"},"wordCount":458,"publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"keywords":["Bitcoin","BTC","CrowdStrike","ETH","ethereum","payments"],"articleSection":["Crime","Featured","Payments"],"inLanguage":"en-US","copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/cryptoslate.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/","url":"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/","name":"Sality botnet disrupted, but crypto-stealing malware remains","isPartOf":{"@id":"https:\/\/cryptoslate.com\/#website"},"datePublished":"2026-09-08T14:35:04+00:00","dateModified":"2026-09-08T14:35:04+00:00","description":"The Sality botnet disruption blocked new payloads, CrowdStrike says, but installed crypto-address-swapping malware still needs removal.","breadcrumb":{"@id":"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cryptoslate.com\/copy-and-paste-crypto-address-attack-remains-active-after-major-malware-cleanup-cut-off-hacker-controls\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptoslate.com\/"},{"@type":"ListItem","position":2,"name":"Active crypto address &#8220;copy and paste attack&#8221; threatens users even after major malware cleanup cut off hackers"}]},{"@type":"WebSite","@id":"https:\/\/cryptoslate.com\/#website","url":"https:\/\/cryptoslate.com\/","name":"CryptoSlate","description":"Cryptocurrency News and Real-time Coin Data","publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"inLanguage":"en-US"},{"@type":"NewsMediaOrganization","@id":"https:\/\/cryptoslate.com\/#organization","name":"CryptoSlate","url":"https:\/\/cryptoslate.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","width":1000,"height":1000,"caption":"CryptoSlate"},"image":{"@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/twitter.com\/cryptoslate","https:\/\/www.instagram.com\/cryptoslate","https:\/\/www.linkedin.com\/company\/cryptoslate","https:\/\/www.youtube.com\/c\/cryptoslate","https:\/\/t.me\/cryptoslatenews","https:\/\/www.crunchbase.com\/organization\/cryptoslate","https:\/\/iq.wiki\/wiki\/cryptoslate","https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ","https:\/\/muckrack.com\/media-outlet\/cryptoslate","https:\/\/www.tiktok.com\/@cryptoslatenews"],"publishingPrinciples":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","ownershipFundingInfo":"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/","correctionsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","ethicsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","foundingDate":"2017-08-04","founder":[{"@type":"Person","name":"Nate Whitehill"},{"@type":"Person","name":"Matthew Blancarte"}],"contactPoint":[{"@type":"ContactPoint","contactType":"customer support","url":"https:\/\/cryptoslate.com\/contact\/","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"sales","url":"https:\/\/cryptoslate.com\/contact\/?topic=advertising#contact-form","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"newsroom","url":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","email":"tips@cryptoslate.com","availableLanguage":"en-US"}],"masthead":"https:\/\/cryptoslate.com\/about\/#masthead"},{"@type":"Person","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/ea2b02b41a7478e18d903ca8eec4979e","name":"Liam 'Akiba' Wright","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-150x150.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-150x150.jpg","caption":"Liam 'Akiba' Wright"},"description":"Also known as \"Akiba,\" Liam Wright is the Editor-in-Chief at CryptoSlate and host of the SlateCast. He believes that together decentralized blockchain and AI technology have the potential to make widespread positive change.","sameAs":["https:\/\/www.akiba.gg","https:\/\/www.instagram.com\/akibablade","https:\/\/twitter.com\/akibablade"],"award":["Most improved footballer - 1992"],"knowsAbout":["Python","Javascript","PHP","HTML","Agentic Software","Machine Learning","2000s emo music","Manchester United"],"knowsLanguage":["English","Spanish"],"url":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/"}]}},"_links":{"self":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/560752"}],"collection":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/users\/1264"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/comments?post=560752"}],"version-history":[{"count":5,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/560752\/revisions"}],"predecessor-version":[{"id":561003,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/560752\/revisions\/561003"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media\/561000"}],"wp:attachment":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media?parent=560752"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/categories?post=560752"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/tags?post=560752"},{"taxonomy":"prediction_market_topic","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/prediction_market_topic?post=560752"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/post_folder?post=560752"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}