Police seize servers of three malware networks and find over 6 million stolen logins

12.11.2026 3 min 21

Police in nine countries, coordinated by Europol, have taken down the servers behind three malware families: the Gootloader loader, the CastleRAT remote access trojan and the StealC password stealer. According to Europol's 12 November announcement, 235 servers and 257 domains were seized or shut down together with private partners. On those servers investigators found more than 6 million logins stolen from infected computers. The headline of the release gives 6.4 million victim datasets.

In brief

  • The action is part of Operation Endgame, the international campaign against tools that open the door to ransomware.
  • Data of CastleRAT victims will go to Have I Been Pwned and other alert services, so people whose passwords were stolen can find out.
  • Europol has not announced any arrests in this round.
235servers taken down
257domains seized
6 M+stolen logins found on the servers

What the three programs did

Gootloader has been active since 2020. Its operators hacked websites, often running WordPress, and planted fake legal documents on them. People who downloaded such a file infected their computer, and Gootloader then pulled in other malware, including ransomware. Police took down 218 Gootloader domains and cleaned up 681 infected websites.

CastleRAT appeared in 2025 and lets an attacker control an infected computer remotely. Europol says it was built to be hard to detect and was used in attacks that encrypted data, crippled whole IT systems and forced companies to pay ransoms. Police seized 120 CastleRAT servers and 39 domains. StealC pulled saved passwords, logins and digital identities from infected computers, and the stolen data was then sold. Police shut down 102 StealC servers. In June 2026 the same operation had already hit StealC together with Amadey and SocGholish, but the stealer kept running.

According to Europol, the suspects sold the stolen logins, and buyers used them for further attacks, ransomware among them. The420.in lists the countries that took part: Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States.

How victims will find out

Europol says victim data will be passed to Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, the Shadowserver Foundation and the Dutch NCSC. The release ties these alerts to the CastleRAT victims. It does not say whether logins stolen by StealC will be shared the same way.

What to do now

  • Subscribe your email to alerts on Have I Been Pwned. If your address turns up in the data passed to the service, you will get a message.
  • If you got such an alert, check the computer for malware first. Changing passwords on an infected machine is pointless, because the new ones will be stolen too.
  • Then change passwords for email, banking and social networks from a clean device and turn on two-factor authentication.
  • If you run a WordPress site, Europol advises changing admin credentials, turning on two-factor login and updating the core, themes and plugins.
Sources:
• 6.4 million victim datasets secured in international operation against malware networks - Europol / Operation Endgame
• Operation Endgame malware takedown turns up over 6 million stolen logins - Help Net Security
• Europol Disrupts Three Malware Networks, Identifies 6.4 Million Stolen Credentials - The420.in

europolmalwarepasswordsinfostealerpolicecybercrimedata breachhave i been pwnedwordpressransomware

Read also