Somewhere in the pile of seized servers sat 6.4 million records stolen from infected computers, each one a set of saved passwords, cookies or session data that a criminal could buy and use. On Nov. 12, Europol and police in nine countries announced they had pulled that pile out of circulation and taken down three malware families at once. The hunt for the owners of those records is only starting.
Read next on Morning Overview: The Justice Department asked courts to undo approvals for three offshore wind farms, one already making power
The malware families are Gootloader, CastleRAT and StealC, and the action was branded Operation Endgame. Authorities seized 235 servers and 257 domains between them, according to the totals reported from the Europol announcement.
Three families, three jobs
CyberScoop’s account of the takedown lists the roles. CastleRAT is a remote access trojan first documented in 2025, and police seized 120 servers and 39 domains tied to it. Gootloader is a dropper spread through fake legal documents on hacked WordPress sites, used as an entry point for ransomware crews, and police took 14 servers and 218 domains and cleaned 681 infected websites.
StealC is the credential thief of the group. A stealer with dropper functions, it harvested passwords for resale, and 102 of its servers were dismantled, building on seizures from June 2026. The per-family counts add up to 236 servers against the stated 235 total, a one-server gap the announcement does not explain.
Gootloader deserves the closest look, because it is the piece that reached ordinary websites. Visitors searching for legal templates landed on hacked WordPress pages that offered fake documents, and the download started an infection chain that other criminals then used as a way into ransomware attacks. Cleaning 681 of those sites is a different kind of win than seizing a server, since each one was a live trap for anyone who happened to search for the right phrase.
Counting what was seized
The size of the haul depends on whose wording is used. Europol titled its release as 6.4 million victim datasets secured, while the body of that release refers to more than 6 million victim credentials found on seized infrastructure. CyberInsider’s write-up uses the same phrase, 6.4 million datasets stolen from malware victims, and does not call them logins.
Some trade coverage, including The Hacker News, put the figure as about 6.4 million stolen logins belonging to more than 40,000 victims. Neither CyberScoop nor CyberInsider repeats the 40,000 number, and the Europol material read for this article does not give it, so it is best treated as one outlet’s reading rather than an official count.
The trade press split on the framing, which matters for anyone checking their own exposure. The Hacker News described the seizure as logins belonging to more than 40,000 victims, while the police material talks about datasets and victims in the millions. A dataset in these cases is typically the full harvest from one infected machine, and one machine can yield many logins, so the three counts are not interchangeable.
The takeaway for readers is practical. Stealer malware does not need a weak password to succeed, because it lifts what a browser has already saved, including session cookies that can skip a login prompt entirely. Changing a password after an infection is therefore only useful once the infected machine itself has been cleaned.
Gootloader’s U.S. toll and the prosecutor’s view
The U.S. Department of Justice says Gootloader infected at least 25,000 computers and was tied to ransomware attacks on at least 44 U.S. victims, with about $28.8 million in losses since 2018. U.S. Attorney Peter McNeilly of the District of Colorado said, in words quoted by CyberScoop, “Cybercrime knows no borders.”
The operation drew on Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States, with Europol and Eurojust coordinating. The Dutch police page for the action, which sits under the same national high-tech crime unit’s June work on Amadey and StealC, shows how the November round extends a campaign that has been running since at least the spring.
Checking whether a login was in the haul
Victim data is being passed to services that notify people. Europol lists HaveIBeenPwned, the Dutch Institute for Vulnerability Disclosure, the Dutch police CheckjeHack service, NoMoreLeaks, Sekoia, the Shadowserver Foundation and the Dutch National Cyber Security Centre as channels. Anyone who suspects an infected device is advised to change the passwords for every account used on it and turn on multi-factor authentication.
WordPress site owners get separate advice, since Gootloader lives on compromised sites: update credentials, enable multi-factor authentication and patch known vulnerabilities. The Operation Endgame news page carries the running list of actions. What authorities have not said is how many of the 6.4 million records are unique accounts as opposed to repeat captures from the same machines, which decides how many people actually need to act.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Neanderthals in Spain carved a wooden object that matches nothing archaeologists have ever found
- The FAA wants $2.39 million from a flight school it says flew a Cessna about 280 times with an unapproved part
- A $1 billion gas plant planned for Superior, Wisconsin, has been abandoned
- Shaq spent $1.3 million on three Rolls-Royce Phantoms to prove a point to a salesman
