Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware
Microsoft and allies disrupt Amadey and StealC malware infrastructure.
Microsoft, Europol, and several cybersecurity firms have collaborated to dismantle the shared command-and-control infrastructure of the Amadey and StealC malware families. This operation, part of the broader Operation Endgame, utilized AI and a vulnerability in a StealC control panel to target hundreds of domains and servers, disrupting the "cybercrime assembly line." The action resulted in the seizure of over 25 million credentials and the identification of 18,000 compromised computers, with crypto assets valued at over $47 million flagged.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Amadey and StealC malware campaigns thrived by leveraging shared command-and-control (C2) infrastructure, effectively creating a scalable 'cybercrime assembly line' that enabled widespread credential theft across thousands of compromised systems. A critical vulnerability in the StealC control panel was ultimately exploited by defenders to help dismantle the network — highlighting that attackers, like defenders, are also exposed to their own software flaws. The seizure of over 25 million credentials underscores how long such operations can persist undetected without robust monitoring and threat intelligence sharing. This case demonstrates the power of coordinated public-private collaboration, AI-assisted analysis, and proactive vulnerability exploitation in offensive disruption operations. Organizations that lacked visibility into C2 communications or delayed credential rotation after compromise remain at significant residual risk.
