cyber.hendryadrian.com
Security News · bleepingcomputer.com

Operation Endgame Disrupts Amadey, StealC and SocGholish Infrastructure

· Original article ↗

Summary

Microsoft, Europol and partners disrupted infrastructure linked to Amadey, StealC and SocGholish. Europol reported 326 servers and 142 domains disrupted; the operation also recovered stolen credentials and identified cryptocurrency linked to criminal activity.

Key points

  • Europol said the operation disrupted 326 servers and 142 domains; ESET separately reported nearly 200 active command-and-control servers were affected.
  • Investigators identified $47 million in cryptocurrency linked to criminal activity and recovered about 27 million stolen credentials, according to the article.
  • Microsoft said Amadey and StealC were linked to more than 140,000 infected devices during the first two weeks of May 2026.
  • Amadey is used to gain an initial foothold and deploy other malware; StealC steals credentials, cryptocurrency wallets and other sensitive information.
  • The coordinated action also targeted SocGholish (FakeUpdates), which infects visitors through compromised websites serving fake browser-update prompts.
  • The article notes that threat actors may rebuild infrastructure if arrests are not made.

Article Details

Event Type
Coordinated law-enforcement and private-sector disruption of infrastructure used by the Amadey, StealC, and SocGholish malware operations under Operation Endgame.
Impact
Europol reported that the operation disrupted 326 servers and 142 domains. Investigators identified more than €41 million in cryptocurrency linked to criminal activity and recovered approximately 27 million stolen credentials from over 385,000 compromised systems. Microsoft said Amadey and StealC were linked to more than 140,000 infected devices during the first two weeks of May 2026; ESET reported that the action affected roughly 50 domains and nearly 200 active command-and-control servers.

Malware

AmadeyMicrosoft, Europol, and international partners disrupted infrastructure used by the Amadey, StealC, and SocGholish (FakeUpdates) malware operations under Operation Endgame.SocGholishMicrosoft, Europol, and international partners disrupted infrastructure used by the Amadey, StealC, and SocGholish (FakeUpdates) malware operations under Operation Endgame.StealCMicrosoft, Europol, and international partners disrupted infrastructure used by the Amadey, StealC, and SocGholish (FakeUpdates) malware operations under Operation Endgame.

Vendors

ESETMicrosoft, ESET, Proofpoint, IBM X-Force, and others helped map and dismantle the malware infrastructure.IBM X-ForceMicrosoft, ESET, Proofpoint, IBM X-Force, and others helped map and dismantle the malware infrastructure.MicrosoftMicrosoft, Europol, and international partners disrupted infrastructure used by the Amadey, StealC, and SocGholish (FakeUpdates) malware operations under Operation Endgame.ProofpointMicrosoft, ESET, Proofpoint, IBM X-Force, and others helped map and dismantle the malware infrastructure.

Countries

CanadaOperation Endgame included law enforcement agencies from Canada, Denmark, Germany, the Netherlands, the United Kingdom, and the United States, with Europol and Eurojust coordinating the effort.DenmarkOperation Endgame included law enforcement agencies from Canada, Denmark, Germany, the Netherlands, the United Kingdom, and the United States, with Europol and Eurojust coordinating the effort.GermanyOperation Endgame included law enforcement agencies from Canada, Denmark, Germany, the Netherlands, the United Kingdom, and the United States, with Europol and Eurojust coordinating the effort.NetherlandsOperation Endgame included law enforcement agencies from Canada, Denmark, Germany, the Netherlands, the United Kingdom, and the United States, with Europol and Eurojust coordinating the effort.United KingdomOperation Endgame included law enforcement agencies from Canada, Denmark, Germany, the Netherlands, the United Kingdom, and the United States, with Europol and Eurojust coordinating the effort.United StatesOperation Endgame included law enforcement agencies from Canada, Denmark, Germany, the Netherlands, the United Kingdom, and the United States, with Europol and Eurojust coordinating the effort.

Related Articles