Europol-Led Operation Endgame Cripples Major Malware Networks, Seizes €41 Million in Crypto

In a landmark international law enforcement action, Europol has announced the dismantling of a sprawling cybercrime infrastructure responsible for stealing cryptocurrency wallet credentials and passwords from hundreds of thousands of victims worldwide. Dubbed ‘Operation Endgame,’ the coordinated effort targeted three major malware families — StealC, Amadey, and SocGholish — which operated under a sophisticated ‘cybercrime-as-a-service’ (CaaS) model.

A Blow to the Malware Supply Chain

Authorities from multiple countries, working alongside private sector partners including Microsoft, executed a sweeping operation that resulted in the shutdown of 326 servers and 142 domain names used to distribute and control the malware. Unlike previous operations that focused on individual botnets or malware strains, Operation Endgame deliberately targeted the entire supply and distribution chain that enabled these threats to proliferate.

The malware families in question were not merely tools for data theft; they were rented out to other criminals on underground forums, creating a self-sustaining ecosystem of digital crime. SocGholish, for example, was widely used to deliver secondary payloads like ransomware, while StealC specialized in exfiltrating browser-stored credentials and cryptocurrency wallet files. Amadey acted as a loader, establishing persistent access on infected machines for further exploitation.

€41 Million in Crypto Frozen, Millions of Credentials Recovered

Beyond the technical disruption, the operation yielded significant financial and intelligence gains. Law enforcement agencies froze approximately €41 million (roughly $47 million) in cryptocurrency assets linked to the criminal network. Additionally, they recovered 27 million sets of login credentials that had been harvested from compromised devices and were being prepared for sale or use in further attacks.

This seizure represents one of the largest cryptocurrency freezes in a coordinated law enforcement action against malware-as-a-service operations. The funds, held in various wallets and exchanges, are believed to be proceeds from credential theft, ransomware payments, and the sale of stolen data on dark web marketplaces.

Why This Operation Matters for Everyday Users

For the average cryptocurrency holder, this takedown removes a significant threat vector. StealC and similar malware often go undetected by traditional antivirus software, silently copying wallet files and saved passwords from browsers. The recovery of 27 million credentials means that many users whose data was compromised may now be protected from future account takeovers, though users are still urged to change passwords and enable two-factor authentication.

The operation also sends a clear signal to the cybercriminal ecosystem: law enforcement is increasingly capable of dismantling not just individual malware strains, but the entire commercial infrastructure that supports them. This supply-chain approach makes it harder for criminals to simply rebuild after a takedown, as the networks of hosting providers, domain registrars, and cryptocurrency exchanges used to monetize their crimes are now under greater scrutiny.

Conclusion

Operation Endgame represents a significant escalation in the fight against cybercrime, demonstrating that international cooperation combined with private sector expertise can effectively disrupt sophisticated criminal enterprises. While new malware will inevitably emerge, the freezing of €41 million in crypto assets and the recovery of millions of stolen credentials provides a tangible victory for law enforcement and a measure of relief for potential victims. The operation underscores the importance of continued vigilance and the need for robust cybersecurity practices among cryptocurrency users.

FAQs

Q1: What is Operation Endgame?
A1: Operation Endgame is a coordinated international law enforcement action led by Europol that targeted and dismantled the infrastructure of three major malware families — StealC, Amadey, and SocGholish — which were used to steal cryptocurrency wallet data and passwords. The operation shut down over 300 servers and froze €41 million in crypto assets.

Q2: How does ‘cybercrime-as-a-service’ work?
A2: Cybercrime-as-a-service (CaaS) is a business model where malware developers rent or sell access to their malicious tools to other criminals. This allows even technically unskilled attackers to deploy sophisticated malware for credential theft, ransomware, or data exfiltration in exchange for a fee or a cut of the profits.

Q3: What should I do if I think my credentials were stolen?
A3: If you suspect your credentials were compromised, immediately change your passwords for all online accounts, especially email, banking, and cryptocurrency exchanges. Enable two-factor authentication (2FA) wherever possible, run a full antivirus scan, and consider using a password manager to generate and store strong, unique passwords.