Authorities seize malware infrastructure in nine-country operation

Europol and law enforcement partners from nine countries disrupted infrastructure linked to the Gootloader, CastleRAT and StealC malware operations, seizing 235 servers and 257 domains and identifying data tied to 6.4 million victims, the agency said November 12, 2026. The action was part of Operation Endgame, an international effort targeting cybercrime networks that supply tools and access for attacks.

Authorities said the identified credentials and victim datasets had been stolen from infected systems and were being sold for use in further cyberattacks, including ransomware. Europol said the victim data would be made available through notification services so people and organizations could check whether their credentials had been compromised. Named services include Have I Been Pwned, the Shadowserver Foundation and the Dutch National Cyber Security Centre.

The takedown covered three types of malware. Europol reported that authorities seized 14 servers and 218 domains linked to Gootloader, and cleaned 681 infected websites. The malware was spread through compromised websites, including WordPress sites, using fake legal documents to lure visitors into downloading malicious...