About 6.4 million stolen logins tied to more than 40,000 victims were seized during an international police action this week, Germany’s Federal Criminal Police Office (BKA) said.
Operation Endgame: an international push led by Europol and partners
The takedown was carried out as part of Operation Endgame, an international campaign targeting malware used to gain access to victims' computers. Europol, which supported the action, reported that investigators seized 235 servers and 257 domains across three malware families: Gootloader, CastleRAT and StealC. No arrests were announced in this week's action, and Dutch police said they are continuing investigations that target Gootloader's main suspect.
Gootloader: a loader spread through hacked websites and SEO poisoning
Gootloader is a loader that, once resident on a computer, can download additional malware — notably ransomware. Investigators say it spread through fake legal documents placed on hacked websites, commonly WordPress sites, and used SEO poisoning to push those pages high in search results. The U.S. Justice Department said Gootloader has infected at least 25,000 computers worldwide since 2018, and that its operators used those infected machines to expand access and sell that access to ransomware groups. In the U.S., the Justice Department linked Gootloader to ransomware attacks on at least 44 victims that resulted in about $28.8 million in losses.
German police published a much higher figure: based on what investigators know so far, Gootloader has infected millions of computers worldwide since it first appeared in 2020. Law-enforcement actions against Gootloader this week included taking down 14 servers and 218 domains and removing malware from 681 hacked websites. With court approval, U.S. agencies and international partners removed Gootloader from more than 100 servers, including hacked WordPress sites, and seized U.S. domains used to deliver and control the malware.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageCastleRAT and StealC: remote access and credential theft
CastleRAT, a remote access trojan first publicly noted in 2025, lets attackers control infected machines remotely. Police seized 120 CastleRAT servers and 39 domains during the operation. StealC is an infostealer that exfiltrates passwords and other login credentials so criminals can sell or misuse them; authorities took down StealC's servers again this week after an earlier June action. Investigators say StealC operators altered their infrastructure following the June takedown, and that some key components ran on Virtualine/Omegatech, a bulletproof hosting service that advertised to criminals. Police shut that hosting service down in a late-October action.
Victim data: seizure, notification and ongoing risk
German authorities said roughly 6.4 million stolen logins belonging to more than 40,000 victims were seized. CastleRAT-extracted data has been loaded into the Dutch police service "Check your hack," where individuals can enter an email address; if the address appears in the data, the police will send an email within a few minutes with steps to remove the malware. If the address is not present, no email is sent. The service checks single addresses rather than whole domains; organizations can instead join "No More Leaks," a police project that shares data with private partners.
The stolen data will also be shared with services including Have I Been Pwned and the Shadowserver Foundation. Shadowserver is coordinating with internet service providers and computer security incident response teams (CSIRTs) to find infected machines and notify their owners, the U.S. Justice Department said. In Germany, the Federal Office for Information Security (BSI) is assisting with victim notification, according to the BKA.
Police warned that even after seizure of the data, criminals may still retain copies of stolen logins; and as long as the malware remains on an infected computer, attackers may continue to collect credentials. Authorities also cautioned that emails purporting to come from police and asking people to check the data are fake — the police never send emails with links.
What this means for WordPress site owners, Denmark's NSK, and hosting providers
- WordPress site owners: Danish police and Dutch guidance set out practical steps — change all administrator passwords to unique, at least 12-character passwords; enable multi-factor authentication; remove unknown accounts; remove any backdoor code; update WordPress core, themes and plugins; and, where possible, restrict access to /wp-admin to your own device IP addresses.
- Denmark's National Special Crime Unit (NSK): NSK helped clean the 681 compromised websites and reported that attackers likely gained access using passwords stolen through criminal channels, then installed a backdoor. Officers removed malicious code and left remediation advice for site owners.
- Hosting providers and bulletproof hosts: the shutdown of Virtualine/Omegatech in late October underlines the role hosting services can play in sustaining or disrupting criminal infrastructure. StealC operators’ attempts to rehome infrastructure after a June takedown show how agile such operations can be.
The operation removed significant infrastructure and delivered a large trove of stolen credentials to law enforcement and partner services, but investigators acknowledge the work is not finished: seizures do not eliminate copies that criminals may already hold, and infected machines can continue to leak credentials until cleaned. With no arrests announced and national police continuing inquiries, the takedown underscores both the scale of the abuse — millions of affected devices, according to one agency — and the dependency of remediation on coordinated notification and cleanup by ISPs, CSIRTs, hosting providers and site owners.
