Microsoft uses AI to link two malware operations in racketeering suit

1. Executive summary

On 2026-06-24, Microsoft's Digital Crimes Unit (DCU), Europol, and industry partners (ESET, BitSight, MBSD, IBM X-Force, Proofpoint, Bitdefender) announced a coordinated disruption under Operation Endgame targeting the shared C2 infrastructure of the StealC infostealer and the Amadey loader. Over 200 domains and C2 servers were taken down, suspended, or blocked; cryptocurrency assets valued at >$47 million were flagged/restricted and ~27 million stolen credentials were recovered. Microsoft used Copilot and AI-assisted tooling to analyse both malware families and link them to a single criminal conspiracy, enabling a civil RICO action against five defendants. EMEA financial services are impacted indirectly: StealC harvests corporate VPN, SSO, and session credentials from unmanaged or personal devices, which are then monetised by access brokers and resold to ransomware operators — a direct supply-chain risk to enterprise environments.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (multi-source corroborated)

1. Initial delivery via Amadey loader. Amadey operates as a malware-as-a-service (MaaS) loader. Threat actors rent Amadey to deliver secondary payloads on compromised devices. Amadey is modular and pay-as-you-go, enabling a single initial infection to escalate into multiple threat deployments including StealC, remote access trojans, cryptominers, and ransomware.
2. StealC infostealer execution. StealC is deployed (often via Amadey) as a secondary payload. It is a MaaS offering that allows threat actors to generate customised payloads and manage stolen data through a centralised web panel.
3. Credential and data harvesting. StealC collects: browser credentials and cookies, cryptocurrency wallet data, chats from messaging applications, email client data, gaming platform data, and other sensitive data. Of particular enterprise concern: corporate VPN credentials, SSO tokens, and session cookies — which can enable MFA bypass.
4. Exfiltration to C2. Stolen data is exported as logs to attacker-controlled C2 servers. Microsoft identified over 200 malicious Amadey and StealC C2 domains and IPs hardcoded into malware binaries.
5. Monetisation via access brokers. Stolen credentials flow through an underground economy of access brokers who validate and monetise stolen credentials, then resell them at a premium to threat actors seeking enterprise footholds — including ransomware operators.
6. Enterprise impact. A single working corporate account unlocked via stolen credentials can provide access to multiple enterprise systems, especially when MFA is bypassed using stolen session cookies. The initial infection typically occurs on unmanaged or personal devices, meaning defenders may only observe the breach after valid credentials are abused.

Scale: In the first two weeks of May 2026 alone, Amadey and StealC were linked to >140,000 infected computers globally (Microsoft, single-sourced for this figure).

AI-assisted analysis (Microsoft DCU methodology): Microsoft used Copilot and AI tooling to: (a) create a prompt agent for comprehensive function analysis; (b) use prompt engineering to generate a Python script for string decryption and extraction of configuration parameters; (c) analyse disassembled malware code and identify C2 servers hardcoded in binaries; (d) write software with Copilot assistance to confirm C2 activity. This enabled DCU to link both malware families to shared infrastructure, supporting a RICO civil action against five defendants described as operating a "MaaS Enterprise" leveraging the "Amadey Malware Suite and StealC Malware Suite."

Disruption action: DCU executed takedown, suspension, and blocking of >200 domains and C2 servers via court orders, domain seizures, registrations, and provider notifications. Combined with the earlier SocGholish disruption, a Europol-led coalition flagged/restricted cryptocurrency assets valued at >$47 million and recovered ~27 million stolen credentials.

Attribution caveat: No MITRE ATT&CK group profiles are resolved for the five named defendants in the verified reference data. Attribution to specific individuals is unconfirmed from the perspective of this advisory. The court documents name five defendants but their identities are not provided in the source material.

Confidence caveat: The >140,000 infected-computers figure and the $47 million / 27 million credential recovery figures are single-sourced to Microsoft and Europol respectively. Verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Block all known StealC/Amadey C2 infrastructure at network egress. Microsoft identified >200 malicious domains and IPs. While the full indicator list is not published in the source material, coordinate with your threat-intel provider to obtain the DCU-published IOC feed and block at firewall, proxy, and DNS resolver levels.
• Hunt for StealC and Amadey artefacts on all endpoints (managed and unmanaged via VPN/MDM). Search for: StealC-generated payload filenames, Amadey loader artefacts, and any processes beaconing to newly blocked C2 domains/IPs. Prioritate endpoints belonging to users with corporate VPN, SSO, or privileged access.
• Invalidate all active session tokens and cookies for any user whose device is suspected or confirmed infected. This is the primary mitigation for MFA bypass via stolen session cookies.
• Force credential rotation for any corporate account whose credentials may have been present on an infected device — including VPN, email, cloud, and SSO accounts.

P2 — Within 72 hours

• Deploy/update EDR detection rules for StealC and Amadey behavioural patterns: infostealer-typical file access patterns (browser profile directories, crypto wallet directories, messaging app data), bulk credential exfiltration, and secondary payload download behaviour consistent with Amadey loader activity.
• Review identity-protection controls. Ensure conditional access policies enforce device compliance checks before granting access to corporate resources — this directly addresses the infostealer infection-on-unmanaged-device vector described by Microsoft.
• Audit third-party service provider credentials. Given that stolen credentials are resold by access brokers, review whether any third-party provider accounts may have been compromised and rotate credentials where risk is assessed as elevated.

P3 — Within 7 days

• Update security awareness training to cover infostealer delivery vectors, particularly for employees using personal devices for corporate access.
• Review and tighten BYOD/unmanaged-device policies. The Microsoft analysis explicitly states that infostealer infections usually happen outside managed endpoints. Ensure VPN/SSO access from unmanaged devices is subject to enhanced scrutiny or restricted.
• Engage with threat-intel feeds for ongoing StealC/Amadey IOC updates, as residual infrastructure may reconstitute.

5. Indicators of compromise

No indicators of compromise available in the source material. The source references >200 malicious domains and IPs identified by Microsoft DCU but does not enumerate them. Coordinate with your threat-intel provider to obtain the DCU-published IOC feed directly.

6. Detection

The source material provides malware family names (StealC, Amadey) and descriptions of their behaviour but does not contain specific strings, file hashes, mutex names, registry keys, scheduled-task names, or hard-coded C2 values that could be used to author YARA or Sigma rules. The >200 C2 domains/IPs referenced are not enumerated in the sources.

Insufficient indicators to author detection rules.

7. Sources

• The Register — "Microsoft uses AI to link two malware operations in racketeering suit" — https://www.theregister.com/security/2026/06/24/microsoft-uses-ai-to-link-two-malware-operations-in-racketeering-suit/5261656 — 2026-06-24
• Microsoft Threat Intelligence — "StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them" — https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/ — 2026-06-24
• SecurityWeek — "Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware" — https://www.securityweek.com/microsoft-and-allies-smash-shared-infrastructure-of-amadey-and-stealc-malware/ — 2026-06-24
• The Hacker News — "Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered" — https://thehackernews.com/2026/06/amadey-and-stealc-malware-network.html — 2026-06-24
• BleepingComputer — "Amadey, StealC malware operations disrupted in Operation Endgame action" — https://www.bleepingcomputer.com/news/security/amadey-stealc-malware-operations-disrupted-in-operation-endgame-action/ — 2026-06-24
• Cybersecurity Dive — "Microsoft, Europol lead global takedown of infostealer malware" — https://www.cybersecuritydive.com/news/microsoft-europol-international-takedown-infostealer-malware/823655/ — 2026-06-24
• Help Net Security — "Law enforcement hits StealC and Amadey malware networks" — https://www.helpnetsecurity.com/2026/06/24/operation-endgame-stealc-amadey-malware-disrupted/ — 2026-06-24

8. Adverse Trace position

This is a significant disruption action but not a zero-day or active-exp exploitation event requiring immediate emergency response. The primary risk to EMEA financial services is residual: StealC and Amadey infrastructure has been disrupted but the credential-theft economy it fed persists, and stolen corporate credentials already in circulation may still be monetised by access brokers. The >140,000 infected computers and 27 million recovered credentials indicate a large-scale operation that almost certainly touched financial-sector employees. Clients should treat this as a trigger to hunt for infostealer artefacts across their estate, invalidate sessions for any potentially compromised users, and tighten identity-centric controls — particularly for unmanaged devices accessing corporate resources. The five-defendant RICO action is unconfirmed in attribution from our reference data; we will monitor for the published IOC feed and any residual C2 reconstitution. We assess this as : actionable but not emergency-priority, with the highest-value defensive work being credential rotation, session invalidation, and conditional-access tightening rather than infrastructure patching.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.