A coordinated law enforcement operation, in partnership with private sector companies, including Bitdefender, Bitsight, ESET, and Microsoft, has resulted in the takedown of criminal infrastructure powering Amadey and StealC.
“The main common goal was to disrupt the ‘assembly lines’ cybercriminals use to launch ransomware, financial fraud, and attacks on critical infrastructure,” Europol said in a statement.
The development comes days after authorities from the Netherlands, Canada, Germany, and the U.S. disrupted malicious infrastructure associated with SocGholish and cleaned up nearly 15,000 infected WordPress websites.
As part of the two-week-long action, cryptocurrency assets of criminal origin valued at more than $47 million have been identified, flagged, and restricted from use. In addition, as many as 27 million stolen login credentials have been recovered, and the malware distribution network has been hindered by dismantling 326 servers and 142 domains.
“This takedown is a powerful demonstration of what public and private sector collaboration can achieve in dismantling the infrastructure that enables cybercrime at scale,” Alex Cosoi, chief security strategist at Bitdefender, said in a statement. “It also sends a clear message to those behind malware ecosystems: no matter how sophisticated the tools or how distributed the network, coordinated international action will find them.”
All three malware families are known to be advertised under a malware-as-a-service (MaaS) model, allowing customers to deliver additional payloads or steal sensitive information from compromised hosts.
SocGholish and Amadey function as loaders for introducing next-stage malware, with the malware primarily disseminated using compromised WordPress sites and phishing campaigns, respectively. Amadey has also been propagated via other loaders like Emmenhtal and SmokeLoader.
A C++-based modular backdoor, it’s known to be active since October 2018 and advertised by a threat actor known as InCrease. The service is priced at $600 for a single license, with an extra $50 charged per rebuild. The latest version of Amadey is 5.87. Some of the supported commands are listed below –
- Fingerprint the machine
- Downloads files, DLLs, MSI, or PowerShell scripts
- Run commands using “cmd.exe”
- Take screenshots
- Spawn a SOCKS proxy
- Open a VNC or reverse proxy session
- Capture clipboard contents and credentials
- Enable RDP
According to data published by Mitsui Bussan Secure Directions, the daily number of active Amadey command-and-control (C2 or C&C) servers ranged roughly between two and 18 until around September 2022.
“From January 2023 to early December 2023, however, this figure rose to between 5 and 30, suggesting that Amadey had come into widespread use,” the Japanese cybersecurity company said. “In 2024, after a brief dormant period, the daily count gradually declined from a peak of 17 and has continued to fall to the present day.”
The number of malware samples distributed via Amadey is said to have scaled a high of 11,635 in 2025, up from 66 in 2019, 260 in 2020, 1,231 in 2021, 3,500 in 2022, 8,360 in 2023, and 7,619 in 2024. Since the start of the year, 1,837 payloads have been distributed through the malware loader.
 |
| Malware dropped by Amadey in 2025 and 2026 and StealC in 2026 |
StealC, on the other hand, has leveraged various initial access vectors ranging from malware loaders (including Amadey) and ClickFix lures, and is equipped to extract sensitive information, such as screenshots, credentials, session cookies, autofill entries, credit card data, browsing history, and extension data.
The malware first surfaced in the wild in January 2023 and sold for $300 per month (or $1,000 for six months) by a threat actor using the moniker “plymouth.” Like Amadey, StealC has been actively maintained by its operators. As of June 2026, the latest version of the stealer is 2.2.1. The highest infection concentrations have been reported in the U.S., Poland, and Italy.
Besides targeting Chromium browsers, the malware harvests data from desktop applications like Discord, FileZilla, Foxmail, Microsoft Outlook, Steam, and Telegram, as well as files matching certain naming patterns. It also acts as a secondary loader, capable of downloading and executing EXE, MSI, or PowerShell payloads based on commands from an external server.
Written in C++, a notable aspect of the stealer is its ability to query the system’s default language and terminate itself if the locale matches countries like Russia, Ukraine, Belarus, Kazakhstan, or Uzbekistan. Amadey also features a similar check to skip certain functionalities like credential stealing and clipboard stealing when running on a Russian, Ukrainian, or Belarusian host.
 |
| A representative infostealer to ransomware attack chain |
Earlier this January, CyberArk disclosed a cross-site scripting (XSS) vulnerability in the web-based control panel by the StealC operators that made it possible to glean insights into the MaaS operation, including one of its customers named YouTubeTA, who has relied on Google’s video sharing platform to distribute the stealer by advertising cracked versions of Adobe Photoshop and Adobe After Effects.
IBM X-Force and Proofpoint also noted that multiple security flaws were identified in the C2 panel, one of which was a directory traversal bug that made it possible to upload a web shell to the StealC C2 server. The issue was patched by StealC developers in February 2026, but not before it was likely exploited by an affiliate to steal data from other affiliates.
“In both ecosystems, affiliates receive a self-hosted administration panel that must be deployed on their own server infrastructure,” ESET researchers Jakub Tomanek and Tomáš Procházka said. “Amadey used a pay-per-rebuild model. Affiliates purchased a license and then paid an additional fee each time they needed to generate a new build, for example, when rotating to a new C&C server.”
“StealC took a more affiliate-friendly approach, offering unlimited build generation as part of its subscription. This lowered the operational cost of rotating C&C infrastructure and made it easier for affiliates to generate new samples as needed.”
A total of 53 unique clusters have been inside the Amadey ecosystem, with the largest botnet cluster distributing payloads like Lumma Stealer, Vidar Stealer, StealC, Rugmi, PureCrypter, Agent Tesla, Rhadmanthys Stealer, RedLine Stealer, SmokeLoader, XWorm, and AsyncRAT.
Microsoft has revealed that not only do Amadey and StealC employ the same infrastructure, but the malware families have been linked to more than 140,000 infected computers globally in the first two weeks of May 2026. The tech giant said it has identified over 18,000 victim computers and severed criminal control of those devices.
In all, the tech giant said it flagged 200 malicious Amadey and StealC C2 domains and IP addresses, all of which have since been shut down using a combination of court orders, domain seizures, registrations, and provider notifications.
 |
|
| Daily trend in the number of active Amadey C2 servers |
“Loaders and stealers are the two halves of the commodity malware pipeline,” Bitsight said. “A loader gets the first foothold and rents it out; a stealer leverages that foothold to collect credentials, cookies, and wallets, to then be sold on underground forums (including Telegram).”
The latest effort, which took place between June 15 and 19, 2026, marks the latest chapter of Operation Endgame. It involved judicial authorities and law enforcement from Belgium, Canada, Denmark, France, Germany, the Netherlands, the U.K., and the U.S.
“Operation Endgame targets the initial access malware used to infect devices,” Eurojust said. “Cybercriminals use this malware as a gateway to silently infiltrate victims’ systems and steal sensitive data. By fighting the initial stage of the attack chain, the operation strikes at the heart of the entire ‘cybercrime-as-a-service’ ecosystem.”
