Microsoft, Europol lead global takedown of infostealer malware

1. Executive summary

On 2026-06-24, Microsoft's Digital Crimes Unit (DCU), Europol, and industry partners (Bitdefender, Bitsight, ESET, IBM X-Force, Proofpoint, Mitsui Bussan Secure Directions) announced a coordinated disruption of the Amadey loader and StealC infostealer malware-as-a-service (MaaS) infrastructure under Operation Endgame. Over 200 malicious C2 domains and IPs were taken down via court orders, domain seizures, and provider notifications; cryptocurrency assets valued at >$47 million were restricted and approximately 27 million stolen credentials were recovered. Microsoft identified >140,000 computers infected with Amadey and StealC globally in the first two weeks of May alone. For EMEA financial services, the primary risk is not the takedown itself but the residual exposure: stolen corporate VPN credentials, SSO tokens, and session cookies harvested prior to disruption remain in criminal circulation and can be used to bypass MFA and establish enterprise access.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (multi-source corroborated)

1. Initial delivery via Amadey loader. Amadey is a MaaS loader used to deliver StealC and other malware (RATs, cryptominers, ransomware) to victim endpoints. Amadey and StealC are developed by separate criminal groups but used shared infrastructure and operated in concert. Infection typically begins on unmanaged or lightly protected devices — including employee personal devices — rather than managed corporate endpoints.
2. StealC execution and data harvesting. Once delivered, StealC (an infostealer MaaS) collects sensitive data from: browsers (credentials, cookies, session tokens), cryptocurrency wallets, messaging applications, email clients, and gaming platforms. StealC also functions as a secondary loader, enabling additional malware downloads on compromised devices.
3. Exfiltration to C2. Stolen data is exported as logs to attacker-controlled C2 servers. DCU identified over 200 malicious Amadey and StealC C2 domains and IPs. C2 servers were hardcoded into malware binaries — Microsoft used Copilot-assisted analysis to identify these by analyzing disassembled malware code and generating a Python script for string decryption and extraction of configuration parameters.
4. Credential monetisation via access brokers. Stolen logs flow through an underground economy of access brokers who validate and resell credentials at a premium to threat actors seeking enterprise footholds. A single working corporate account can unlock many enterprise systems, especially if MFA is bypassed using stolen session cookies.
5. Escalation to ransomware, financial fraud, or critical infrastructure attacks. Europol stated the common goal was to disrupt the "assembly lines" cybercriminals use to launch ransomware, financial fraud, and attacks on critical infrastructure. Experts confirm many ransomware attacks begin with stolen credentials and session cookies harvested by infostealers and sold to affiliates through access brokers.

Key technical details

• Scale: >140,000 infected computers globally in the first two weeks of May 2026 (Microsoft data). Operation Endgame overall: 385,000 compromised systems and 25.6 million stolen credentials recovered (Proofpoint/IBM researcher data — note: The Register cites ~27 million credentials; the discrepancy likely reflects different counting methods or timing).
• Infrastructure disrupted: >200 C2 domains and IPs taken down via court orders, domain seizures, registrations, and provider notifications. Microsoft filed with the U.S. District Court in Miami, bringing civil claims against five defendants under the Racketeer Influenced and Corrupt Organizations Act (RICO), treating Amadey and StealC as a single conspiracy due to shared infrastructure.
• Cryptocurrency assets: >$47 million in cryptocurrency assets flagged and restricted by Europol-led coalition (includes earlier SocGholish disruption).
• AI-assisted analysis: Microsoft DCU used Copilot to: (a) create a prompt agent for comprehensive function analysis, (b) generate a Python script for string decryption and extraction of configuration parameters, (c) analyze disassembled malware code to identify hardcoded C2 servers, and (d) write software to confirm C2 activity. This reduced analysis time from "hours or days to minutes."
• Related infostealer families named in Microsoft's analysis: StealC, Lumma Stealer, RedLine, Raccoon, Vidar — all part of the same commoditised infostealer economy.

Unconfirmed / single-sourced claims

• Attribution to specific named defendants is unconfirmed — Microsoft filed against "a series of unnamed defendants." No MITRE ATT&CK actor profiles are referenced in the available source material; no named threat actor group is identified. Attribution is to the MaaS operations collectively, not to a specific tracked group.
• The exact number of recovered credentials varies by source (25.6 million per Proofpoint/IBM via Cybersecurity Dive; ~27 million per The Register). This is single-sourced in each case; treat both as approximate.

4. Mitigation & containment

P1 — Within 24 hours

1. Block all known C2 infrastructure at network controls. Instruct network/firewall teams to block any traffic to domains and IPs associated with Amadey/StealC C2 infrastructure. Note: the specific domain/IP list is not published in the available source material. Contact Microsoft DCU or Operation Endgame partners (ESET, Bitdefender, Proofpoint) for threat-intelligence feeds containing the >200 identified C2 indicators. Do not assume the infrastructure is fully neutralised — residual C2 nodes may persist.
2. Force credential rotation for high-risk populations. Priorise employees who use personal or unmanaged devices for corporate access (BYOD, remote workers). Rotate passwords and revoke active sessions for: corporate VPN, SSO/IdP, email, cloud consoles. Enforce re-authentication rather than relying on existing session cookies.
3. Hunt for StealC and Amadey artefacts on managed endpoints. While infections typically originate on unmanaged devices, secondary delivery and lateral movement may reach managed assets. Search EDR/EDR telemetry for: new processes spawned from browser processes (StealC injection), unexpected network connections to unknown domains, and bulk credential/file access patterns consistent with infostealer behaviour.

P2 — Within 72 hours

4. Audit and invalidate session tokens. Review IdP/SSO session token lifetimes and revoke all long-lived sessions. Implement session-token binding or short TTLs to reduce the window of opportunity for stolen-cookie replay. This is the primary technical control against the MFA-bypass vector described in the attack chain.
5. Deploy EDR detection for infostealer behaviour. Configure detection rules for: credential access via browser credential stores (e.g., LSASS-adjacent access to browser memory), bulk file reads of browser profile directories, and exfiltration to unknown external endpoints. See §6 for YARA and Sigma rules.
6. Review BYOD and personal-device policies. The attack chain explicitly notes that initial infection "usually happens outside managed endpoints." Ensure BYOD policies require endpoint security controls on any device accessing corporate resources. Consider conditional access policies that block authentication from devices without compliant security posture.

P3 — Within 7 days

7. Conduct a stolen-credential audit. Check corporate credentials against recovered credential datasets. Contact Operation Endgame partners (Proofpoint, IBM X-Force) to determine whether any institutional credentials appear in the 25–27 million recovered credentials. This is the most direct way to confirm whether your organisation was in the victim population.
8. Update threat-intelligence feeds. Incorporate Amadey and StealC IOCs from Microsoft's threat-intelligence blog and partner feeds into SIEM, firewall, proxy, and EDR platforms. Monitor for any resurgence of infrastructure under new domains.
9. Brief incident response teams. Ensure IRTs understand the infostealer-to-ransomware chain and can identify the "stolen credential used with valid session" pattern, which may appear as legitimate authentication in logs. The key indicator is authentication from an unusual device/IP/location using a valid token.

5. Indicators of compromise

No specific IOCs (IPs, domains, hashes, file names) are published in the available source material. The sources reference ">200 malicious Amadey and StealC command-and-control domains and IPs" but do not enumerate them. Microsoft's blog post and court filings may contain the specific indicators — clients should request them directly from Microsoft DCU or Operation Endgame partner threat-intelligence feeds.

Confidence caveat: The existence of >200 C2 domains/IPs is multi-source corroborated (Microsoft, BleepingComputer, SecurityWeek, The Register, Cybersecurity Dive). The specific values are not available in the provided sources. Single-sourced; verify before enforcement.

No indicators of compromise available in the source material.

6. Detection

The source material does not provide specific file hashes, domain names, IP addresses, mutex names, or registry keys. However, Microsoft's blog post provides sufficient behavioural and technical detail to author detection rules based on the described malware capabilities and attack patterns.

YARA rule — based on StealC/Amadey capability descriptions from Microsoft Threat Intelligence blog

rule Infostealer_StealC_Amadey_Operation_Endgame {
    meta:
        author = "Adverse Trace"
        date = "2026-06-25"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/"
        description = "Detects StealC infostealer and Amadey loader based on capability indicators described in Microsoft DCU analysis"
        note = "String-based detection from source-described artefacts; no hashes available in source material"
    strings:
        // StealC targets: browser credentials, cookies, session tokens, crypto wallets, messaging apps, email clients, gaming platforms
        $browser_cred1 = "Login Data" nocase
        $browser_cred2 = "Cookies" nocase
        $browser_cred3 = "Local State" nocase
        $crypto_wallet1 = "wallet" nocase
        $crypto_wallet2 = "metamask" nocase
        $crypto_wallet3 = "exodus" nocase
        $messaging1 = "Telegram" nocase
        $messaging2 = "Discord" nocase
        $email_client1 = "Outlook" nocase
        $gaming1 = "Steam" nocase
        // C2 exfiltration patterns
        $c2_indicator1 = "/api/logs" nocase
        $c2_indicator2 = "/panel/" nocase
        // MaaS panel references
        $maas1 = "stealc" nocase
        $maas2 = "amadey" nocase
    condition:
        // Require at least 3 browser/credential strings AND one C2 or MaaS indicator
        (3 of ($browser_cred*)) and (1 of ($c2_indicator*) or 1 of ($maas*))
        or
        // Or require crypto/messaging/email/gaming targeting AND MaaS indicator
        (2 of ($crypto_wallet*, $messaging*, $email_client*, $gaming*)) and (1 of ($maas*))
}

Sigma rule — behavioural detection of infostealer exfiltration pattern

title: Infostealer Credential Exfiltration Pattern - StealC/Amadey
id: AT-2026-06-25-168-sigma-01
status: experimental
description: >
    Detects behavioural pattern consistent with StealC/Amadey infostealer activity:
    browser credential store access followed by network exfiltration to unknown endpoint.
    Based on attack chain described in Microsoft DCU Operation Endgame analysis.
references:

    - https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/
    - https://www.theregister.com/security/2026/06/24/microsoft-uses-ai-to-link-two-malware-operations-in-racketeering-suit/5261656/
author: Adverse Trace
date: 2026/06/25
logsource:
    product: windows
    category: process_creation
detection:
    selection_browser_access:
        CommandLine|contains:

            - "Login Data"
            - "Local State"
            - "Cookies"
            - "Web Data"
        Image|endswith:

            - "\\chrome.exe"
            - "\\msedge.exe"
            - "\\firefox.exe"
            - "\\brave.exe"
    filter_legitimate:
        Image|endswith:

            - "\\chrome.exe"
            - "\\msedge.exe"
            - "\\firefox.exe"
            - "\\brave.exe"
        ParentImage|endswith:

            - "\\explorer.exe"
            - "\\svchost.exe"
    selection_network_exfil:
        # Look for processes making network connections after credential access
        # This is a proxy — actual detection requires network + process correlation
        Image|endswith:

            - "\\powershell.exe"
            - "\\cmd.exe"
            - "\\rundll32.exe"
            - "\\regsvr32.exe"
        CommandLine|contains:

            - "Invoke-WebRequest"
            - "curl"
            - "Invoke-RestMethod"
    condition: (selection_browser_access and not filter_legitimate) or (selection_browser_access and selection_network_exfil)
falsepositives:

    - Legitimate browser credential management tools
    - Enterprise SSO agents accessing browser credential stores
level: high

Caveat: These rules are constructed from capability descriptions in the source material, not from confirmed binary strings or observed artefacts. They should be treated as starting-point detections to be refined with actual IOCs from Microsoft or partner threat-intelligence feeds. Single-sourced; verify before enforcement.

7. Sources

• Cybersecurity Dive — "Microsoft, Europol lead global takedown of infostealer malware" — https://www.cybersecuritydive.com/news/microsoft-europol-international-takedown-infostealer-malware/823655/ — 2026-06-24
• BleepingComputer — "Amadey, StealC malware operations disrupted in Operation Endgame action" — https://www.bleepingcomputer.com/news/security/amadey-stealc-malware-operations-disrupted-in-operation-endgame-action/ — 2026-06-24
• The Hacker News — "Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered" — https://thehackernews.com/2026/06/amadey-and-stealc-malware-network.html — 2026-06-24
• SecurityWeek — "Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware" — https://www.securityweek.com/microsoft-and-allies-smash-shared-infrastructure-of-amadey-and-stealc-malware/ — 2026-06-24
• Microsoft Threat Intelligence — "StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them" — https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/ — 2026-06-24
• Help Net Security — "Law enforcement hits StealC and Amadey malware networks" — https://www.helpnetsecurity.com/2026/06/24/operation-endgame-stealc-amadey-malware-disrupted/ — 2026-06-24
• The Register — "Microsoft uses AI to link two malware operations in racketeering suit" — https://www.theregister.com/security/2026/06/24/microsoft-uses-ai-to-link-two-malware-operations-in-racketeering-suit/5261656/ — 2026-06-24

8. Adverse Trace position

This is a significant law-enforcement disruption but the threat to EMEA financial services is residual, not immediate. The C2 infrastructure has been partially neutralised, but stolen credentials and session tokens harvested before the takedown remain in criminal circulation and represent the primary ongoing risk. The attack chain — infostealer on unmanaged device → stolen corporate VPN/SSO/session cookies → MFA bypass → enterprise access → ransomware or fraud — is well-corroborated across multiple sources and directly relevant to financial institutions with remote/BYOD workforces. No specific IOCs are available in the source material; we will request the >200 C2 domain/IP indicators from Microsoft DCU and Operation Endgame partner feeds and distribute them to clients as a follow-up. Attribution to specific defendants is unconfirmed — Microsoft filed against unnamed defendants and no MITRE ATT&CK actor profiles are referenced. Clients should immediately prioritise session-token revocation, credential rotation for BYOD/high-risk users, and EDR detection-rule deployment using the YARA and Sigma rules in §6 as interim controls pending verified IOCs. We assess this as a item: actionable but not requiring emergency response. The regulatory engagement under DORA Arts. 17–19 is triggered if stolen corporate credentials are confirmed to have been used for enterprise access.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.