In a coordinated display of international police power, law enforcement agencies from across the globe have dealt a significant blow to the cybercrime ecosystem. On June 24, 2026, Europol announced the latest phase of "Operation Endgame," a sprawling, multi-year multinational campaign designed to dismantle the digital infrastructure that sustains the global ransomware economy.
This specific iteration of the operation targeted the "upstream supply chain" of cybercrime: the Amadey loader and the StealC infostealer. By neutralizing 326 servers and 142 domains, and freezing approximately $47 million in illicit cryptocurrency, authorities have disrupted the primary "assembly lines" that transform unsuspecting users into victims of data theft, account takeover (ATO), and ransomware.
The Anatomy of the Strike: What Was Dismantled?
The operation, which unfolded over a two-week window, targeted the foundational tools that allow attackers to gain persistent access to corporate and personal devices.
The Amadey Loader: Opening the Door
Since 2018, Amadey has operated as a "dropper-as-a-service." In the dark economy, it serves as the initial point of entry. Distributed primarily through sophisticated phishing campaigns and malicious spam (malspam), Amadey establishes a foothold on a victim’s machine. Once the infection is successful, the loader acts as a gateway, downloading whatever malicious payloads the highest bidder—usually ransomware gangs or initial access brokers—wishes to deploy.
The StealC Infostealer: Emptying the House
If Amadey is the lockpick, StealC is the vacuum. Since its emergence in early 2023, StealC has become the preferred tool for harvesting sensitive data. It systematically scrapes browser-stored credentials, passwords, session cookies, and multi-factor authentication (MFA) tokens. These data points are then funneled to underground marketplaces, where they are sold to threat actors specializing in corporate espionage and financial fraud.
Microsoft’s telemetry indicates the scale of the threat, linking these two malware families to more than 140,000 infected computers globally in the first two weeks of May 2026 alone. The synergy between Amadey and StealC is a cornerstone of modern cybercrime: the former provides the access, and the latter extracts the value.
Chronology of the Operation
Operation Endgame is not a singular event, but a sustained, multi-phased pressure campaign. Its success relies on the synergy between the European Cybercrime Centre (EC3), the Joint Cybercrime Action Taskforce (J-CAT), and Eurojust.
- Mid-June 2026: The momentum began building with the takedown of the SocGholish infrastructure. On June 18, Dutch police led a successful action against the "fake browser update" operation, which has long been linked to the notorious Evil Corp syndicate.
- Late June 2026: The focus shifted to Amadey and StealC. Over a fourteen-day period, law enforcement agencies from Canada, Denmark, Germany, the Netherlands, the United Kingdom, and the United States synchronized their efforts to seize control of server nodes and domain registrars.
- June 24, 2026: Europol officially announced the results of the operation. By this time, investigators had already secured 27 million stolen login credentials, preventing them from being weaponized in further fraud campaigns.
The operation was supported by a coalition of private-sector giants, including Microsoft’s Digital Crimes Unit (DCU), Proofpoint, IBM X-Force, ESET, Bitdefender, Lumen, the Shadowserver Foundation, and Have I Been Pwned. This "public-private partnership" model is increasingly viewed as the gold standard for combating infrastructure-heavy cybercrime.
Supporting Data and Technical Impact
The sheer volume of the seizure underscores the industrial scale of modern malware operations.
Infrastructure and Financials
The takedown of 326 servers and 142 domains effectively blinded the command-and-control (C2) capabilities of the botnets. Beyond the hardware, the identification and freezing of approximately EUR 41 million (approx. $47 million USD) in cryptocurrency represents a direct strike against the financial incentives that keep these criminal enterprises profitable.
The Data Harvest
The recovery of 27 million stolen credentials from 385,000 compromised systems is a staggering figure. These credentials represent the "keys to the kingdom" for millions of users. By recovering this data, authorities have effectively neutralized a significant portion of the current inventory of initial access brokers.
The credentials have been cross-referenced and integrated into the Have I Been Pwned database. This allows for a massive "clean-up" effort, as individuals and organizations can now verify if their information was part of the compromised sets and force mandatory password resets.
Implications for ESPs and Email Senders
For the email marketing and security industries, Operation Endgame is of particular significance. Infostealers are currently the primary drivers of account takeover (ATO) in the marketing space.
The Danger of Session Tokens
StealC is particularly lethal because it does not just steal passwords; it steals session cookies. In a modern security environment where MFA is standard, a stolen session cookie allows an attacker to bypass the second-factor check entirely, as the platform "believes" the user is already authenticated.
When a malicious actor gains access to an Email Service Provider (ESP) dashboard using these stolen tokens, they gain the ability to send authenticated, high-reputation mail. Because the IP address is already warmed and trusted by receiving mail servers, these malicious campaigns are far more likely to bypass traditional spam filters. This turns an ESP’s own infrastructure against itself, leading to rapid degradation of domain reputation and delivery rates.
A Temporary Reprieve
By removing 27 million credentials from the dark web, the operation has created a "friction point." Many of the credentials currently being used to fuel phishing campaigns are now stale or unusable due to forced resets. However, industry experts caution that this is a temporary victory. The primary delivery route for this malware remains malspam—a vector that relies on the very channel that legitimate senders use to communicate.
Official Responses and Strategic Outlook
Law enforcement officials are clear-eyed about the nature of these operations. While the numbers—326 servers, 142 domains—are impressive, the history of Operation Endgame suggests that the criminal actors behind these tools are resilient.
Previous phases of the operation successfully dismantled IcedID, Smokeloader, Bumblebee, DanaBot, and Rhadamanthys. Yet, these families rarely disappear permanently. They frequently rebrand, rewrite their source code, and resurface under new names, as seen with the rapid regrowth of phishing-as-a-service kits like Tycoon 2FA.
The Measure of Success
"We are not looking for total extinction, as that is functionally impossible in an decentralized digital landscape," a source close to the investigation noted. "We are measuring success by the cost of operation for the criminals. Every time we take down their infrastructure, we force them to rebuild, re-train their recruits, and re-purchase their assets. We are increasing the cost of doing business to the point where the criminal model becomes less attractive."
Conclusion: What Senders Should Do Now
The immediate aftermath of Operation Endgame requires proactive behavior from all stakeholders.
- Check Exposure: Platform operators and email senders should check their domains against the updated Have I Been Pwned database to identify any compromised accounts.
- Mandate Resets: Do not wait for evidence of a breach. Given the scale of the 27 million stolen credentials, a proactive global password reset and session invalidation for all users is the most prudent security posture.
- Monitor Traffic: Senders should continue to monitor for anomalous spikes in mail volume or unusual geographic access patterns to their ESP dashboards.
As the industry awaits further data—including potential shifts in global malspam volumes following the seizures—the message from Europol is clear: the "assembly line" has been disrupted, but the factory remains. Vigilance, combined with the continued collaboration of global authorities and the private sector, remains the only viable path to securing the digital ecosystem.
