Operation Endgame: Europol-led takedown dismantles StealC and Amadey infostealer infrastructure; 326 servers seized, 27 million stolen credentials recovered

An international law enforcement operation has dismantled the infrastructure behind two malware strains, StealC and Amadey, as part of Operation Endgame, Europol announced on June 24. The two-week action, running from June 15 to 19, involved judicial authorities and law enforcement from Belgium, Canada, Denmark, France, Germany, the Netherlands, the United Kingdom and the United States. Germany's Federal Criminal Police Office led the investigation, coordinated by Europol's European Cybercrime Centre and the Joint Cybercrime Action Taskforce, with legal support from Eurojust. Authorities seized 326 servers and 142 domains, recovered 27 million stolen login credentials, and identified and restricted more than $47 million in cryptocurrency assets tied to criminal activity. Microsoft's Digital Crimes Unit disrupted over 200 command-and-control servers and identified more than 18,000 victim computers, using AI tools including Copilot to analyze the malware and linking both families to the same infrastructure. In the first two weeks of May 2026, the two malware strains were tied to more than 140,000 infected computers worldwide, according to Microsoft. StealC is an infostealer designed to extract passwords, stored credentials and digital identities from compromised machines. Amadey functions as a loader that introduces additional malware into infected systems. Europol described them as forming a critical link in the cybercrime supply chain. Private-sector partners included BitSight, ESET, IBM X-Force, Lumen, Microsoft, Mitsui Bussan Secure Directions and Proofpoint.