On June 24, 2026, Microsoft’s Digital Crimes Unit and a coalition of law enforcement partners under Operation Endgame pulled the plug on hundreds of command-and-control servers behind StealC and Amadey, two of the busiest commodity malware families feeding the credential underground. The two were built by separate criminal crews, yet they run in tandem: one kicks the door in, the other empties the house. If your cybersecurity program still thinks about malware as a single named blob that an engine either catches or misses, this takedown is a useful reminder that you’re up against an assembly line, and assembly lines get rebuilt.

The headline is a win. Hundreds of servers seized, domains sinkholed, infrastructure that delivered infostealers to untold numbers of machines knocked offline in a single coordinated push involving Microsoft, Proofpoint, and several national police forces. Take the win. Then plan for the part nobody puts in the press release: the operators behind a rented service rarely retire. They re-provision.

Hundreds Of C2 Servers Seized, Two Malware Families Crippled

Operation Endgame has become the largest sustained campaign to dismantle cybercrime infrastructure, and StealC plus Amadey are its latest scalps. Microsoft’s writeup is a technical breakdown of how the two families share plumbing: delivery channels, packers, and in many cases the same victims. Law enforcement didn’t just grab a few boxes. They mapped the backbone and pulled it out from underneath the operators.

What got hit matters less than how the two pieces fit together. Amadey is a loader, a small piece of code whose entire job is to land on a machine, phone home, and pull down whatever the buyer paid to install next. StealC is an infostealer, the thing that actually rifles through your browser credential stores, session cookies, crypto wallets, and saved passwords, then ships them out. Amadey is the delivery truck. StealC is the crew that loots the building. You can rent either one, or both, by the week.

Amadey Loads, StealC Steals: Anatomy Of A Rented Pipeline

This is the part worth internalizing. The attacker who hit one of your endpoints probably didn’t write a line of either tool. They bought access to a loader-as-a-service, paid per successful install, and pointed it at a stealer payload. The skill floor is a credit card and a Telegram handle.

Because the components are modular, the names on your alert console are the least durable thing in the whole operation. Amadey can drop StealC today, a different stealer tomorrow, a ransomware loader next month. The packers rotate to dodge signature scanners. The C2 domains cycle constantly. What stays the same is the behavior: a small unsigned binary establishing outbound persistence, then a second-stage process reaching into credential storage and beaconing to an address your users have never visited. Grade software by what it does on the box, not by the family label a vendor managed to attach to it. Signature-based threat-protection still earns its keep, and it will keep missing the freshly repacked sample that lands an hour after the takedown.

The downstream damage is the real story. Infostealers feed a wholesale market in valid credentials and live session tokens. Those logs get sold, and the buyer walks straight past your firewall with a legitimate-looking login. According to the 2026 Verizon DBIR, stolen credentials and non-CVE issues account for the majority of breach entry points, which means the loot from a StealC run is exactly the fuel for the next intrusion. Killing the servers does nothing to the credentials already harvested and already for sale.

The Cybersecurity Math: Why This Infrastructure Regrows In Weeks

Takedowns disrupt; they don’t delete. The economics are simple. A loader operator’s fixed costs are bulletproof hosting and a builder kit, both of which are cheap and replaceable. The day after Operation Endgame, the surviving affiliates spin up fresh domains and resume selling installs. We have watched phishing-as-a-service and proxy botnets resprout within days of similar operations, and infostealer crews are no different.

So the question for your team is not whether the StealC brand survives. It’s whether your detection and response can handle the next commodity stealer that wears a different name and the same behavior. That is a defense-in-depth problem, and it’s the only framing that holds up when the threat infrastructure is designed to be disposable. Your threat detection has to key on the loader-then-stealer pattern and the post-theft credential abuse, because those are the two stages that survive every rebrand.

Endpoint Hardening And Incident Response Before The Respawn

Treat the takedown as a free window to close gaps before the infrastructure comes back. Some of this is immediate, some is ongoing, and none of it depends on a specific product.

• Sweep for the foothold now. Hunt for small unsigned binaries with outbound persistence and recent process spawns touching browser credential stores. Loaders are quiet; you have to go look.
• Assume credentials already walked. Force password resets and invalidate active sessions for any host showing stealer behavior. A reset that leaves the old session token alive is theater.
• Cap session lifetime and bind tokens. Short-lived sessions and device-bound tokens blunt the value of stolen cookies, which is what StealC sells.
• Put brute-force controls on every auth endpoint. Stolen credentials get sprayed and stuffed across VPNs, mail, and admin panels; rate-limiting and lockouts raise the cost of replaying them.
• Run phishing-resistant MFA. Hardware-backed MFA keeps a stolen password from becoming a session.
• Tighten outbound egress. Loaders and stealers both need to talk out. Egress filtering and DNS monitoring at the firewall turn a silent beacon into an alert.
• Rehearse credential-typed incident response. Run the tabletop where the entry point is a valid login from a stealer log, not an exploit. The playbook is rotation, session kill, and blast-radius mapping.

The ongoing work is security hardening that assumes the delivery layer is permanent. Application allowlisting stops unknown loaders from executing. Browser credential storage policies shrink what a stealer can grab. Off-host logging means a wiped endpoint doesn’t erase your evidence. None of these care what the malware is called this week, which is exactly the point.

Good cyber security here looks boring on purpose. You instrument the behavior, you shorten the life of stolen credentials, and you rehearse the response so that the next stealer, whatever it’s called, runs into the same wall this one did. The coalition did the hard part this week. The respawn is yours to plan for.

Sources

• StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them
• Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware
• Law enforcement hits StealC and Amadey malware networks