Operation Endgame: Global Law Enforcement Takedown Disrupts SocGholish, Amadey, and StealC Malware-as-a-Service Networks
Operation Endgame (TL-2026-0937), also tracked as Operation Endgame, is a high-severity malware campaign, first published 2026-06-24. It is attributed to InCrease with medium confidence, affects Microsoft Windows, maps to 42 MITRE ATT&CK techniques (T1005, T1016, T1021.001), and is covered by 9 detection rules and 31 indicators of compromise.
Key facts for TL-2026-0937
- Threat ID
- TL-2026-0937
- Also known as
- Operation Endgame, FakeUpdates takedown, SocGholish takedown, Amadey takedown, StealC takedown
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-24
- Last reviewed
- 2026-06-24
- Attribution
- InCrease
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- financial, government, healthcare, technology, retail, critical-infrastructure, education
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in Operation Endgame
Malware and tooling: Emmenhtal, Lumma Stealer - S1213, Smoke Loader - S0226, js.fakeupdates, win.amadey, win.stealc, Keitaro TDS, NetSupport RAT, Parrot TDS
A coordinated international operation under the Operation Endgame banner, announced by Europol and the Microsoft Digital Crimes Unit on 24 June 2026, disrupted the distribution and command-and-control infrastructure of three prolific commodity malware families: the SocGholish (js.fakeupdates) JavaScript loader, the Amadey (win.amadey) loader/botnet, and the StealC (win.stealc) information stealer. Enforcement actions between 15-19 June 2026 dismantled 326 servers and 142 domains, recovered roughly 27 million stolen credentials, and identified/restricted more than EUR 41 million (USD 47 million+) in criminal crypto assets.
How Operation Endgame works
On 24 June 2026, Europol — working with Eurojust, the Microsoft Digital Crimes Unit (DCU), and private-sector partners Bitdefender, Bitsight, and ESET — announced a landmark disruption of the criminal infrastructure behind three of the most widely used Windows commodity malware families as the latest chapter of Operation Endgame. Law-enforcement and judicial authorities from Belgium, Canada, Denmark, France, Germany, the Netherlands, the United Kingdom, and the United States participated. The actions, carried out between 15 and 19 June 2026, targeted the cybercriminal 'assembly lines' — the loaders, stealers, and distribution networks that feed downstream ransomware, financial fraud, and attacks on critical infrastructure — rather than individual infections.
The SocGholish (also tracked as FakeUpdates) network was disrupted first, in actions led by the Netherlands, Canada, the United States, and Germany with Europol and Eurojust support, with public reporting placing the SocGholish action on or around 18 June 2026. SocGholish is a JavaScript-based loader in use since at least 2017, operated by the actor cluster Mustard Tempest (MITRE G1020) and historically used to broker access sold to groups such as Indrik Spider for follow-on RAT and ransomware delivery. It spreads through drive-by 'fake update' lures injected into compromised, legitimate websites — nearly 15,000 compromised WordPress sites were identified and remediated as part of the operation — frequently fronted by traffic-distribution systems such as Parrot TDS and Keitaro TDS and abusing domain shadowing.
The Amadey and StealC disruption was executed jointly with the Microsoft DCU, which severed criminal control of roughly 18,000 victim computers and disabled approximately 200 C2 domains/IPs. Amadey is a modular loader/botnet active since October 2018 (latest tracked version 5.87), sold by a threat actor using the moniker 'InCrease' for roughly USD 600 per license plus USD 50 per rebuild. Amadey performs host fingerprinting, downloads and executes secondary payloads (DLL, MSI, PowerShell), runs commands via cmd.exe, captures screenshots, spawns SOCKS proxies and VNC/reverse-proxy sessions, harvests credentials and clipboard data, and can enable RDP. It is distributed via compromised WordPress sites, phishing, and upstream loaders such as Emmenhtal and SmokeLoader, and across roughly 53 affiliate clusters has delivered Lumma Stealer, Vidar, StealC, RedLine, Rhadamanthys, Agent Tesla, PureCrypter, Rugmi, SmokeLoader, XWorm, and AsyncRAT. Amadey reuses its CreateMutexA mutex name as the RC4 key for encrypting C2 traffic and includes CIS locale checks that disable theft on Russian, Ukrainian, and Belarusian systems.
StealC is a C++ information stealer first observed in January 2023, operated by an actor using the handle 'plymouth'; the StealC v2 line (latest tracked 2.2.1, sold at roughly USD 300/month or USD 1,000 for six months) was rebuilt in early 2025 with server-side decryption, expanded browser/wallet coverage, and PowerShell/MSI loader functionality. It extracts credentials, session cookies, autofill and credit-card data, browsing history, and application data from Chromium browsers and desktop apps (Discord, FileZilla, Foxmail, Outlook, Steam, Telegram), and is delivered via loaders (including Amadey) and ClickFix social-engineering lures. StealC samples are frequently protected with the Themida packer and apply CIS geo-blocking (Russia, Ukraine, Belarus, Kazakhstan, Uzbekistan). In early 2026 the StealC ecosystem itself drew scrutiny: CyberArk disclosed a stored XSS in the StealC web panel (Jan 2026), and a directory-traversal flaw allowing web-shell upload to StealC C2 servers was patched in Feb 2026 after exploitation. Microsoft reported 140,000+ devices infected by the combined operations in the first two weeks of May 2026.
This record documents a defensive intelligence picture of the takedown for SOC hunting and detection validation. Although the criminal infrastructure was disrupted, the malware families, builders, and affiliate tradecraft remain in circulation, so detection and hunting for the associated TTPs and residual IOCs remain warranted.
MITRE ATT&CK techniques used in TL-2026-0937
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1113 Screen Capture; T1115 Clipboard Data
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1482 Domain Trust Discovery; T1518 Software Discovery; T1614 System Location Discovery
Lateral Movement
T1021.001 Remote Desktop Protocol
Defense Evasion
T1027.013 Encrypted/Encoded File; T1027.015 Compression; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218.007 Msiexec; T1497.001 System Checks
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.007 JavaScript; T1106 Native API; T1204.001 Malicious Link; T1204.002 Malicious File
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1573.001 Symmetric Cryptography
Initial Access
T1189 Drive-by Compromise; T1566.002 Spearphishing Link
Privilege Escalation
Affected products and versions in Operation Endgame
- Microsoft — Windows
Vulnerable versions: Windows (all supported desktop/server versions running affected malware) - Multiple — Chromium-based browsers and credential stores
Vulnerable versions: Google Chrome 132+; Microsoft Edge; other Chromium browsers (23+ targeted) - Automattic — WordPress (compromised sites used for SocGholish distribution)
Vulnerable versions: ~15,000 compromised sites identified
Remediation for Operation Endgame
Patches
- No CVE applies to this threat; ensure CMS platforms (WordPress core/plugins) are patched to prevent site compromise used for SocGholish injection
Immediate actions
- Block and alert on the disrupted C2 IPs and Amadey/StealC URI patterns (/index.php, /rock/index.php) at the perimeter and on proxy logs
- Hunt for SocGholish fake-update JavaScript executions (wscript/cscript launching obfuscated .js) and ClickFix clipboard-paste PowerShell across endpoints
- Force-reset credentials for any account whose secrets may have been exfiltrated by StealC/Amadey; invalidate active browser session cookies
- Scan WordPress and other CMS estates for injected fake-update scripts and unauthorized subdomains (domain shadowing)
Workarounds
- Block execution of wscript.exe/cscript.exe via attack-surface-reduction rules where business needs allow
- Restrict outbound traffic to categorized/known-good destinations to disrupt C2 over HTTP
Longer-term hardening
- Deploy EDR with behavioral detection for loader/stealer chains (mshta/wscript/powershell spawning from browsers, schtasks and Run-key persistence)
- Enforce phishing-resistant MFA to blunt the value of stolen credentials and cookies
- Implement application allow-listing and disable script-host execution for standard users
- Subscribe to credential-leak monitoring to detect exposure of harvested corporate credentials
Timeline of Operation Endgame
- SocGholish (FakeUpdates) JavaScript loader first observed in the wild, operated by the Mustard Tempest cluster and used to broker access for follow-on RAT and ransomware payloads.
- Amadey loader/botnet first appears, sold as malware-as-a-service by the actor 'InCrease'; later iterations reach version 5.87.
- StealC C++ information stealer emerges on underground markets, operated by the actor 'plymouth' as a Vidar/Raccoon-style stealer-as-a-service.
- StealC v2 rebuilt with a new codebase: server-side decryption, expanded browser/wallet coverage, Themida packing, and PowerShell/MSI loader functionality (latest tracked version 2.2.1).
- CyberArk discloses a stored cross-site scripting (XSS) vulnerability in the StealC web control panel; affiliate 'YouTubeTA' observed distributing StealC via cracked-Adobe YouTube lures.
- Directory-traversal flaw permitting web-shell upload to StealC C2 servers (reported by IBM X-Force/Proofpoint) is patched by the operators following exploitation.
- Microsoft observes 140,000+ devices globally infected by the combined SocGholish/Amadey/StealC operations in the first two weeks of May 2026.
- Coordinated Operation Endgame enforcement actions against the malware infrastructure begin (window 15-19 June 2026).
- SocGholish/FakeUpdates infrastructure disrupted in actions led by the Netherlands, Canada, the United States, and Germany with Europol and Eurojust support; ~15,000 compromised WordPress sites identified for remediation.
- Europol and the Microsoft Digital Crimes Unit publicly announce the Amadey and StealC takedown: 326 servers and 142 domains dismantled, ~27 million stolen credentials recovered, EUR 41M+/USD 47M+ crypto identified and restricted, ~18,000 victim machines freed and ~200 C2 domains/IPs disabled by Microsoft.
Sources cited for Operation Endgame
- Global cyber strike disrupts SocGholish, Amadey, and StealC malware networks
- Malpedia Library: Global cyber strike disrupts SocGholish, Amadey, and StealC malware networks
- Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered
- Operation Endgame Disrupts StealC, Amadey and SocGholish Malware Networks
- Europol-Led Operation Endgame Takes Down StealC and Amadey Infostealers
- Three 'cybercrime as a service' operations undercut by Microsoft, law enforcement
- Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware
- SocGholish, Software S1124 | MITRE ATT&CK
- StealC v2 Malware Enhances Stealth and Expands Data Theft Features
- Amadey Threat Analysis and Detections
- Amadey Exploiting Self-Hosted GitLab to Distribute StealC
- Bitsight Aids Disruption Efforts on Amadey & StealC Malware
Threats related to Operation Endgame
- Stealer Logs: Infostealer Malware Ecosystem Fuels Credential-Theft Economy (LummaC2, Rhadamanthys, Vidar 2.0, StealC, AMOS/MacSync/Poseidon/Odyssey)
- Operation Endgame Disrupts StealC Infostealer and Amadey Loader/Botnet Infrastructure (326 Servers, 142 Domains, 27M Credentials, EUR41M Seized)
- OXLOADER Malware Loader Delivering CASTLESTEALER .NET Infostealer via Node.js Malvertising
- Millenium RAT v4: C++ Rewrite Fuels Y2K Operators' MaaS Campaign (62,289 Devices, 160+ Countries)
- EtherRAT: Node.js Remote Access Trojan with Ethereum Blockchain C2 Resolution and Per-Execution Self-Reobfuscation
- Latrodectus Loader: Three-Stage JScript/VBScript Obfuscation Delivers WMI/msiexec MSI Payload (sokingscrosshotel[.]com)
Detection coverage for TL-2026-0937
As of 2026-06-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0937 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.