Reported by 1 outlet

Timeline

1. original reporting

   Operation Endgame Disrupts Amadey and StealC — Simultaneous Court-Ordered Takedown Takes Down 326 Servers, Recovers 27M Credentials

   bleepingcomputer.com · 111d ago · June 25th, 2026

   Microsoft, Europol, and partners from five countries executed a novel dual-malware disruption targeting the shared infrastructure of Amadey botnet and StealC infostealer — both sold as malware-as-a-service and frequently used together in ransomware intrusion chains. For the first time, a court-authorized takedown under the RICO Act simultaneously targeted two cybercrime tools.

   Results: 326 servers and 142 domains seized, blocked, or sinkholed. €41 million (~$47M) in cryptocurrency linked to criminal activity identified. Approximately 27 million credentials recovered from over 385,000 compromised systems. The operation also targeted SocGholish (FakeUpdates) infrastructure. Private partners included ESET, Proofpoint, IBM X-Force, Bitsight, and Spamhaus. Microsoft's Digital Crimes Unit used its AI Copilot to identify connections between the two malware families as part of a single criminal enterprise.

   Between them, Amadey (active since 2018) and StealC (active since 2023) were linked to 140,000+ infected devices in the first two weeks of May alone. StealC has been the infostealer behind recent ClickFix campaigns on TikTok. While infrastructure disruptions rarely stop operations permanently unless arrests are made, this is the most significant coordinated action against the infostealer-as-a-service ecosystem to date.

   ---