Endgame phase hits Amadey and StealC, recovers 27 million stolen logins
Europol said June 24 that the latest Operation Endgame phase also disrupted the Amadey malware loader and the StealC infostealer, recovering about 27 million stolen login credentials and restricting more than €41 million in criminal cryptocurrency. Canada took part through the RCMP.
Infostealers quietly copy passwords, session cookies and other credentials from infected computers, and those logs are sold to criminals who use them to break into company networks. Microsoft said Amadey and StealC infected more than 140,000 computers worldwide in just the first two weeks of May 2026, Security Affairs reported.
What happened
The action ran from June 15 to 19 and was coordinated by Europol, with police from Canada, Denmark, Germany, the Netherlands, the United Kingdom and the United States. Microsoft, Bitdefender, IBM X-Force, Proofpoint, Infoblox, Shadowserver and Orange Cyberdefense were among more than a dozen private partners. In total, 326 servers and 142 domains were actioned.
The RCMP's June 25 release put the crypto assets identified, flagged and restricted at more than $66 million in Canadian dollars, and said about 15,000 websites were remediated in the SocGholish portion, which the RCMP's Vancouver team led for Canada.
Amadey has operated since October 2018 as a paid dropper service, spreading mostly through phishing. It gives attackers initial access, loads other malware and can steal credentials and clipboard contents. StealC appeared in January 2023 and harvests stored passwords, digital identities and other sensitive data for resale. Spain's national CERT, INCIBE-CERT, said nearly 9,000 infected devices in Spain yielded more than 535,000 credentials.
Victim notification
Notification is running through services including Have I Been Pwned, Spamhaus, Shadowserver, the Dutch Institute for Vulnerability Disclosure and the Dutch National Cyber Security Centre. No arrests were announced; Endgame has a portal seeking information about suspects, and authorities said the investigation remains open.
What to do
- Check your email addresses on Have I Been Pwned, which received credential data from the operation.
- If a computer may have been infected, clean or rebuild it first, then change passwords from a clean device.
- Revoke active sessions and turn on multi-factor authentication for important accounts, since stolen cookies can bypass passwords.
- Organizations should monitor for logins using leaked employee credentials and reset them.
