Operation Endgame disrupts Amadey and Stealc

ESET Research contributed to a global disruption operation targeting the Amadey botnet and Stealc infostealer, both malware-as-a-service offerings. The operation, coordinated by Microsoft Digital Crimes Unit, BitSight, Lumen, and MBSD, impacted approximately 50 domains and nearly 200 active IP-based command and control servers. ESET provided technical analyses, statistical information, C&C server lists, encryption keys, campaign identifiers, and affiliate-level insights gathered from three years of tracking. Both malware families operate through affiliate networks where operators deploy their own infrastructure, making disruption efforts particularly challenging. Amadey primarily functions as a modular loader distributing additional payloads, while Stealc focuses on credential theft from browsers, crypto wallets, and applications. The largest Amadey botnet cluster accounted for 34% of all samples and distributed an average of 14 payloads per victim, operating a pay-per-install model that monetized compromi...

• StealC Is Back, and This Time It's a RATMalware2026-10-22
• Disposable Domains, Durable HostingMalware2026-09-23
• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05
• RARLAB WinRAR · Gorbag: Orcs at the border harvesting intelligence from UkraineExploitedMalware2026-11-03
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31