Europol disrupts malware networks and recovers millions of stolen credentials

International police and cybersecurity partners have disrupted infrastructure used by three malware families and identified more than six million stolen victim credentials in a new phase of Operation Endgame, Europol announced on 12 November. Authorities and private organisations took action against 235 servers and 257 domains associated with the criminal networks.

The operation targeted Gootloader, CastleRAT and StealC, which have been used for initial system compromise, remote access and theft of sensitive information. Europol said the infrastructure helped criminals conduct further offences including fraud and ransomware attacks.

The data identified by investigators include stolen credentials and other victim records. The figure should not be reported as a verified count of distinct people affected: one person may have multiple compromised accounts, and the recovery of records does not show that all copies have been eliminated.

Participating authorities came from several European countries, Canada, the United Kingdom and the United States, with Europol and Eurojust supporting intelligence and judicial coordination. Victim-alert services are expected to help notify affected users about the compromised information.

For businesses, the operation is a reminder that stolen passwords can remain exploitable after a malicious server is dismantled. Europol urges users, including WordPress administrators, to update compromised credentials, enable multifactor authentication and address known software vulnerabilities. The investigation also illustrates why law-enforcement seizures and private-sector remediation need to work together.

Have a verified news development or correction? Contact news@inafrika.co.tz.