Operation Endgame takedown uncovers 6 million stolen logins

International Crackdown on Malware Infrastructure

Law enforcement agencies across nine countries, collaborating with Europol, have successfully dismantled the server infrastructure supporting three major malware operations: Gootloader, CastleRAT, and StealC. This coordinated strike, part of the ongoing Operation Endgame initiative, resulted in the seizure of over 6 million stolen credentials harvested from compromised computers. The operation targets the criminal services that facilitate ransomware gangs’ initial access to corporate networks, disrupting the supply chain of digital theft.

The recovered login data represents a direct threat to both individual users and enterprises. Criminal syndicates sold these harvested credentials to buyers who utilized them to launch further attacks, including ransomware deployments. To mitigate the risk for affected parties, victim data linked to CastleRAT will be shared with notification platforms such as Have I Been Pwned. Consequently, individuals and organizations whose passwords were compromised may soon receive alerts regarding their exposure.

Seizing Control of Digital Assets

The joint effort between Europol and private-sector partners led to the removal of 235 servers and 257 domains from criminal control. The breakdown of seized assets highlights the scale of each operation’s infrastructure:

• Gootloader: Operators lost 14 servers and 218 domains.
• CastleRAT: Authorities seized 120 servers and 39 domains.
• StealC: A total of 102 servers were taken offline.

In addition to infrastructure seizures, 681 infected websites were cleaned up during the operation. These efforts significantly degraded the capabilities of the malware operators, preventing further distribution of malicious payloads through their established channels.

Targeting Specific Malware Families

Each targeted malware family served a distinct role in the cybercriminal ecosystem. Gootloader functions as a loader, designed to infiltrate systems and download additional malicious software. Its operators frequently planted fake legal documents on compromised websites, particularly hacked WordPress installations. Users who downloaded these deceptive files became infected, leading to subsequent ransomware and extortion campaigns.

CastleRAT, identified as a remote access trojan, has been active since 2025. Europol notes that this tool was engineered to evade detection while allowing attackers to control infected machines remotely. The agency links CastleRAT to incidents involving encrypted data, crippled IT systems, and organizations forced to pay ransoms.

StealC operates as an infostealer capable of deploying other malware onto target devices. It extracts passwords, saved logins, and digital identities from infected computers for sale and fraudulent use. This week’s takedown of StealC’s 102 servers continues a campaign against the group that began in June 2026.

Security Recommendations for Users

Following the disruption of these operations, Europol is urging all WordPress users to take immediate security precautions. Recommendations include changing existing credentials, enabling multi-factor authentication (MFA), and applying necessary patches to fix known vulnerabilities. These steps are critical for protecting against future attempts by remaining elements of these criminal networks.