Europol seizes 235 servers and 257 domains in Endgame malware operation

What Europol announced

Europol announced on 12 November 2026 a new action under Operation Endgame, its effort against cybercrime. Authorities seized 235 servers and 257 domains in the operation, which was carried out with private companies.

The targets were three malware families: Gootloader, CastelRAT and StealC. Europol said it had already acted against StealC, SocGholish and Amadey in June this year.

The agency said the operation targeted 'cybercrime-as-a-service' models, in which such tools enable other crimes, including ransomware attacks and data theft.

Countries involved

Authorities from Germany, Bulgaria, Canada, the United States, Moldova, the Netherlands, Poland and the United Kingdom supported the action, according to Europol.

Europol said it identified 6.4 million victim credentials during the operation. Data on affected victims will be made available on sites such as HaveIBeenPwned, which the authorities described as a warning to those affected.

The malware families

According to the authorities, Gootloader is a dropper and loader distributed through compromised websites. The source report describes CastelRAT and StealC as remote-access and information-stealing tools respectively.

Europol did not say in the report whether arrests were made or which suspects, if any, have been identified. The agency also did not give a timeline for publishing the victim data.