# Operation Endgame Disrupts StealC Infostealer and Amadey Loader/Botnet Infrastructure (326 Servers, 142 Domains, 27M Credentials, EUR41M Seized)

> Europol/Eurojust, Microsoft DCU, Proofpoint, IBM X-Force, ESET, Bitdefender, Bitsight, Infoblox, Orange Cyberdefense, Shadowserver and law enforcement from Belgium, Canada, Denmark, France, Germany, the Netherlands, the UK and the US executed a June 15-19, 2026 Operation Endgame action against the Amadey loader/botnet and StealC infostealer, seizing 326 servers and 142 domains, recovering roughly 27 million stolen credentials from over 385,000 systems, and identifying/freezing approximately EUR 41 million (USD 47 million) in cryptocurrency. A CyberArk-disclosed XSS flaw and an IBM X-Force/Proofpoint-found directory-traversal web-shell-upload bug in StealC's own PHP-based C2 panel were leveraged by researchers to infiltrate operator sessions ahead of the takedown.

- **Published:** 2026-06-30T00:00:00Z
- **Last reviewed:** 2026-06-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1022
- **ID:** TL-2026-1022
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MITIGATED
- **Actor:** Amadey (Russia)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On June 24, 2026, Europol and Eurojust announced the latest phase of Operation Endgame, a multi-year, multi-agency campaign against malware droppers and infostealers that function as the initial-access 'assembly line' for ransomware and extortion operations. This action, carried out June 15-19, 2026, targeted the Amadey loader/botnet and the StealC information stealer, and followed a related June 18, 2026 disruption of the SocGholish (FakeUpdates) malware framework -- attributed to the Evil Corp criminal group -- which remediated roughly 14,971-15,000 compromised WordPress websites under the same operational umbrella.

Amadey has operated as a paid dropper/loader-as-a-service since October 2018, sold on Russian-language cybercrime forums. It functions as an initial-access broker: distributed via phishing, malvertising, cracked-software downloads, and historically bundled with SmokeLoader (which injects Amadey into Windows Explorer processes), Amadey performs credential harvesting, clipboard hijacking, reconnaissance, and modular follow-on payload delivery, including ransomware and remote access tools. It is used by both financially motivated ransomware affiliates and, per reporting, state-sponsored actors leveraging it for initial access. Researchers identified 53 unique clusters within the Amadey ecosystem, indicating multiple affiliate operators sharing the same core loader.

StealC, first observed in the wild in late 2022/January 2023 and offered as Malware-as-a-Service (MaaS) in C++, is a copycat/evolution of the Vidar and Raccoon infostealer families. StealC harvests browser-stored credentials and cookies, cryptocurrency wallet data (browser extension and desktop wallets), instant-messenger (Telegram) and email client (Outlook) data, gaming platform credentials (Steam), VPN configurations, and performs file-grabbing and multi-monitor screenshot capture. StealC V2 (current as of v2.2.4, released March 2025) introduced a streamlined JSON-based C2 protocol with four operation types (create, upload_file, done, loader), RC4-encrypted traffic (from v2.1.1+), Themida packing, two-stage Base64+RC4 string deobfuscation, CIS-region self-termination checks, duplicate-instance prevention, and (in v1) VM/sandbox detection later removed in v2. The malware is distributed via ClickFix-style social engineering (fake TikTok tutorial videos, FileFix variants prompting victims to paste and execute PowerShell) and via fake Adobe software promoted by a YouTube-based traffic-acquisition affiliate. StealC and Amadey have a bidirectional distribution relationship: Amadey drops StealC, and StealC's loader operation type can in turn deliver additional payloads including Amadey, evidencing coordinated affiliate infrastructure.

The takedown was substantially enabled by two vulnerabilities researchers found in StealC's own PHP-based web control panel. CyberArk researcher Ari Novick disclosed (January 2026) a cross-site scripting flaw in which the panel failed to sanitize user-supplied input, allowing injected JavaScript to execute in the context of an authenticated operator's browser session -- enabling researchers to harvest session cookies, enumerate the operator's browser/system fingerprint, and unmask their real IP address and hardware profile. Separately, IBM X-Force and Proofpoint identified a directory-traversal bug in the panel's file-upload handling: the backend stored uploaded files under their original filename using a sanitization routine that failed to strip forward slashes, allowing a crafted filename with path-traversal sequences to escape the intended temp directory and write a PHP web shell directly to the C2 server filesystem, granting researchers/law enforcement remote code execution on StealC infrastructure ahead of the disruption. Both flaws were patched by the StealC developer in February 2026, after they had already been leveraged for evidence collection and infiltration.

Operational metrics: 326 servers and 142 domains were seized, sinkholed, or blocked across the combined Amadey/StealC/SocGholish action (with a narrower June sub-action affecting 66 domains and 296 servers specifically tied to Amadey/StealC, and Microsoft separately flagging 200+ malicious C2 domains/IPs and severing criminal control over roughly 18,000 victim machines). Investigators tracked over 140,000 infected devices globally during a two-week window in May 2026, with the highest infection concentrations in the United States, Poland, and Italy. Researchers recovered more than 25.6-27 million unique stolen credentials from over 385,000 compromised systems. Europol identified, flagged, and restricted approximately EUR 41 million (~USD 47 million) in cryptocurrency assets of criminal origin. Victim notification was coordinated through Have I Been Pwned, DIVD, Spamhaus, CheckjeHack, NoMoreLeaks, Shadowserver, and the Dutch National Cyber Security Centre. No arrests were publicly disclosed as part of this action; consistent with prior Operation Endgame phases, operators are expected to attempt infrastructure rebuilding, so continued monitoring for successor Amadey/StealC C2 infrastructure and any rebrand is warranted.

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1115 Clipboard Data
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities

## Sources

- [Operation Endgame disrupts StealC, Amadey malware operations](https://www.helpnetsecurity.com/2026/06/24/operation-endgame-stealc-amadey-malware-disrupted/)
- [Amadey, StealC malware operations disrupted in Operation Endgame action](https://www.bleepingcomputer.com/news/security/amadey-stealc-malware-operations-disrupted-in-operation-endgame-action/)
- [Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered](https://thehackernews.com/2026/06/amadey-and-stealc-malware-network.html)
- [Operation Endgame Disrupts StealC, Amadey and SocGholish Malware Networks](https://hackread.com/operation-endgame-stealc-amadey-socgholish-malware/)
- [Operation Endgame hits StealC and Amadey](https://www.bitdefender.com/en-us/blog/hotforsecurity/operation-endgame-stealc-amadey-malware-takedown)
- [Europol Disrupts StealC and Amadey Malware Infrastructure in Operation Endgame](https://securityaffairs.com/194173/cyber-crime/europol-disrupts-stealc-and-amadey-malware-infrastructure-in-operation-endgame.html)
- [Operation Endgame Hits StealC and Amadey: 326 Servers Seized, 27 Million Stolen Credentials Recovered](https://breached.company/operation-endgame-stealc-amadey-takedown-2026/)
- [Operation Endgame official site](https://www.operation-endgame.com/)
- [I StealC You: Tracking the Rapid Changes To StealC](https://www.zscaler.com/blogs/security-research/i-stealc-you-tracking-rapid-changes-stealc)
- [StealC v2 Malware Enhances Stealth and Expands Data Theft Features](https://www.picussecurity.com/resource/blog/stealc-v2-malware-enhances-stealth-and-expands-data-theft-features)
- [Stealc Malware: Analysis, Detection, Removal](https://www.huntress.com/threat-library/malware/stealc)
- [Static Analysis: StealC Infostealer](https://www.cynet.com/blog/static-analysis-stealc-infostealer/)
- [Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity - Part 1](https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/)
- [Bitsight Aids Disruption Efforts on Amadey & StealC Malware](https://www.bitsight.com/blog/bitsight-aids-disruption-efforts-on-amadey-malware-and-stealc-malware)
- [Amadey Info Stealer and N-Day Vulnerabilities](https://www.darktrace.com/blog/amadey-info-stealer-exploiting-n-day-vulnerabilities)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1022