Apneal, the user who first discovered the Ethereum address modifying malware, stated that the malware was only spotted after a few transactions were already made. First, Apneal sent a small transaction of 0.01 Ether from a cryptocurrency exchange to a personal wallet address. But noticed that the personal wallet address used in the facilitation of the payment had not received an incoming transaction, which meant that the transaction was either not broadcasted to the Ethereum blockchain network or it was set to another address.
Read Full: PC Malware Steals Funds by Modifying Ethereum Addresses