In one of the most consequential coordinated cybercrime takedowns of 2026, law enforcement agencies and private-sector partners spanning multiple continents have dealt a significant blow to two of the most pervasive malware-as-a-service platforms currently operating — Amadey and StealC. The action, conducted under the banner of Operation Endgame, dismantled critical criminal infrastructure, disrupted ransomware supply chains, and surfaced tens of millions of dollars in illicit cryptocurrency holdings.
The Scope of the Disruption
The numbers alone signal the scale of this operation. Investigators succeeded in taking down, seizing, or sinkholing 326 servers and 142 domains directly tied to the two malware families. Alongside that infrastructure work, authorities identified more than €41 million — approximately $47 million — in cryptocurrency connected to criminal activity. Perhaps most striking is the human cost embedded in those figures: roughly 27 million stolen credentials were recovered from over 385,000 compromised systems, a sobering reminder of the real-world victims behind every botnet statistic.
Europol and Eurojust coordinated the effort across national agencies from Canada, Denmark, Germany, the Netherlands, the United Kingdom, and the United States. On the private side, contributions came from Microsoft's Digital Crimes Unit, ESET, Proofpoint, IBM X-Force, Bitsight, Infoblox, Orange Cyberdefense, Shadowserver, Have I Been Pwned, Spamhaus, and additional partners. Microsoft pursued a parallel civil action in U.S. federal court, identifying more than 200 malicious command-and-control domains and IP addresses and securing takedowns through court orders, domain seizures, and direct provider notifications.
Understanding the Threat: What Amadey and StealC Actually Do
To appreciate why dismantling these two platforms matters, it helps to understand where they sit in the modern cybercrime kill chain.
Amadey: The Door Opener
Amadey functions as a malware loader and botnet controller — its primary value to criminal operators is gaining an initial foothold on victim machines and then deploying additional payloads. That could mean ransomware, remote access tools, or lateral movement frameworks. Its client list is alarmingly broad: Amadey has been leveraged by both financially motivated ransomware gangs and state-sponsored threat actors alike, making it one of the more democratized intrusion tools in the underground economy.
StealC: The Credential Harvester
StealC operates as an infostealer, targeting saved browser credentials, cryptocurrency wallets, session tokens, and other sensitive data. Once harvested, that information flows into underground marketplaces or is packaged and sold through initial-access brokers — intermediaries who resell compromised network access to ransomware operators and other threat actors. Recently, StealC has been prominently deployed in so-called ClickFix campaigns, where victims are socially engineered into executing malicious commands disguised as legitimate technical prompts — a technique observed across fake video platforms and compromised document workflows.
"By taking down these tools simultaneously, the collaboration between law enforcement and private parties has increased friction for cybercriminals, making it harder for attacks to succeed, spread, or recover." — Europol
Microsoft's telemetry underscores just how active these platforms were immediately before the disruption: the two malware families were linked to more than 140,000 infected devices in the first two weeks of May 2026 alone.
Operation Endgame's Expanding Footprint
This latest phase builds on an already formidable track record. Previous Endgame actions have disrupted DanaBot, Bumblebee, Rhadamanthys, VenomRAT, Elysium, and SmokeLoader — a roster that reads like a who's who of the cybercrime-as-a-service ecosystem. The current action also extended to SocGholish (also known as FakeUpdates), a JavaScript-based loader that compromises victims through hijacked websites serving fraudulent browser update prompts.
The consistent targeting of loader and dropper infrastructure is strategically deliberate. By severing the tools that ransomware gangs and data extortion groups depend on to establish initial access, law enforcement is attacking the supply chain rather than individual criminal actors — a model that generates compounding disruption across multiple downstream operations simultaneously.
The Persistent Challenge: Resilience Without Arrests
Despite the impressive operational results, security professionals should temper their optimism with realism. History shows that when cybercriminal infrastructure is dismantled without corresponding arrests and prosecutions, threat actors frequently rebuild within weeks or months. New command-and-control servers are stood up, replacement domains are registered, and affiliate networks reconstitute under fresh branding. The underlying operators often remain at large, protected by jurisdictional complexities or operating from regions where extradition is practically impossible.
This structural limitation does not diminish the value of infrastructure takedowns — they impose real costs, delay attack timelines, and disrupt revenue streams — but it does highlight why disruption operations must be paired with sustained intelligence collection and, wherever legally feasible, criminal prosecution.
What You Should Do
Operation Endgame represents law enforcement and industry at their collaborative best. But the cybercrime ecosystem it targets is adaptive, well-funded, and largely insulated from prosecution. The disruption buys time — how defenders use that time will determine whether this operation translates into lasting resilience or merely a brief interruption in criminal activity.
