Police in nine countries with Europol seize 6 million stolen credentials

This week, authorities in nine countries cooperating with Europol took down servers used by Gootloader, CastleRAT and StealC and recovered more than 6 million stolen credentials from infected computers. The countries are Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States, with Europol and Eurojust coordinating. Europol called the effort the latest stage of Operation Endgame, the international campaign targeting access services that ransomware gangs use to enter networks.

Authorities working with Europol and private partners seized 235 servers and 257 domains from the criminals, and the same operation resulted in the cleanup of 681 infected websites. Officials counted 6.4 million victim datasets on the criminal infrastructure, stolen materials from malware-infected systems used to support other cyber attacks including ransomware breaches. Europol said investigators identified over 6 million victim credentials in criminal infrastructure and seized them during the week, and that suspects sold the stolen credentials for later use in cyber attacks such as ransomware.

The operation seized 14 servers and 218 domains belonging to Gootloader, 120 servers and 39 domains belonging to CastleRAT, and 102 servers belonging to StealC. The move against StealC’s 102 servers builds on work against the infostealer that began in June 2026.

Gootloader works as a loader, malware that places other malicious code on a machine. Gootloader operators placed fake legal documents on compromised websites, typically hacked WordPress sites, and visitors who downloaded them became infected. Those infections led to ransomware and extortion.

CastleRAT works as a remote access trojan that lets attackers control a machine from afar, and it first appeared in 2025. Europol says its design makes detection difficult. Europol ties CastleRAT to encrypted data, crippled IT systems and companies and organizations forced to pay ransoms.

StealC works as an infostealer, malware that steals data from infected machines, and can also install malware on a machine. StealC took passwords, saved logins and digital identities from infected computers to sell them for fraud. Buyers who purchased credentials taken from infected computers used them for further attacks including ransomware.

In June 2026, Operation Endgame took down infrastructure tied to Amadey and StealC, recovering roughly 27 million credentials from more than 385,000 hacked systems and shutting down 326 servers and 142 domains. That same month, the operation removed malware from nearly 15,000 WordPress websites and seized 106 servers tied to the SocGholish botnet and the Evil Corp Russian cybercrime group.

One year ago, a joint law enforcement action seized more than 1,000 servers used by Rhadamanthys, VenomRAT and Elysium botnet operations. Earlier rounds of Operation Endgame went after customers and servers for the Smokeloader botnet, ransomware infrastructure, the AVCheck site and malware operations such as DanaBot, IcedID, Pikabot, Trickbot, Bumblebee and SystemBC. The first Operation Endgame began May 28, 2024, involved a dozen countries and disabled more than 100 servers used by malware groups including IcedID, Smokeloader, Pikabot and Bumblebee.

The seller behind StealC brought back the operation with Stadia four months after Europol disrupted StealC in Operation Endgame. Stadia, a new remote access trojan for Windows that lets attackers control a machine remotely, steals credentials and was advertised on Oct. 16, 2026.

Stadia draws on code from StealC v3.5 while adding features that go beyond information theft. Stadia uses six modules: hidden virtual network computing, a tool that lets attackers secretly control a machine’s desktop, along with Remote CMD, a loader, File Explorer, Process Manager and a stealer. The stealer component goes after more than 50 browsers, 50 desktop wallets and 120 cryptocurrency browser extensions, plus messaging and gaming applications. Access to all six modules costs $300 per month for Basic, $550 per month for Team and $900 per month for Pro, and former StealC customers receive one free month on the Pro tier.

Varonis Threat Labs analyzed a 560,128-byte, 32-bit Windows executable and found a 26,112-byte Chromium App-Bound Encryption helper inside the sample that matches a component in StealC v3.5 byte-for-byte. Stadia checks the system language and shuts down on machines set to Russian, Ukrainian, Belarusian, Kazakh or Uzbek. It then installs itself in a randomly named folder under C:\ProgramData\ using filenames that resemble legitimate Windows or software update processes such as MicrosoftEdgeUpdate.exe and SearchHost.exe.

Stadia sets up a hidden scheduled task that runs at logon and every 15 minutes. With elevated privileges, it uses PowerShell to add its installation folder to Microsoft Defender’s exclusion list. Stadia sends HTTP POST requests carrying RC4-encrypted data encoded in Base64, even though the requests label their content as application/json.

Varonis tells defenders to watch for suspicious behavior such as unsigned processes injecting code into suspended browser processes, hidden scheduled tasks created without notice and unexpected Microsoft Defender exclusions. Hackread reports that Stadia’s return shows the limits of infrastructure takedowns when malware operators keep their code and customer base.

Victim data tied to CastleRAT will go to notification services including Have I Been Pwned. Europol is urging WordPress users to change passwords, enable multifactor authentication and patch vulnerabilities. “WordPress users are urged to update credentials, enable multi-factor authentication, and patch vulnerabilities,” Europol said.