# International operation dismantles malware networks, exposes 6.4 million stolen credentials

Source: [CyberScoop](https://cyberscoop.com/operation-endgame-malware-takedown-gootloader-stealc-europol/) · 2026-11-12 · Security
Page: https://themorning.dev/story/international-operation-dismantles-malware-networks-exposes-6-4-million-stolen-c-eae739ae6c0783d7
Kind: security · Impact: medium

## In brief

- Police in nine countries, working with Europol, took down infrastructure behind the Gootloader, CastleRAT and StealC malware operations.
- Sources report 235 servers and 257 domains seized, and more than 6 million credentials recovered from infected computers (CyberScoop cites 6.4 million victims).
- The action was announced as part of the latest round of Operation Endgame.

## Why it matters

Credentials stolen by these malware families were used for ransomware attacks and data theft, so developers should consider whether accounts or systems they use may have been exposed through infected machines.

## Timeline

- 2026-11-12: Europol announces takedown of Gootloader, CastleRAT and StealC infrastructure

## Coverage

- [International operation dismantles malware networks, exposes 6.4 million stolen credentials](https://cyberscoop.com/operation-endgame-malware-takedown-gootloader-stealc-europol/) — CyberScoop, 2026-11-12
- [Police dismantle Gootloader, CastleRAT, StealC malware infrastructure](https://www.bleepingcomputer.com/news/security/police-dismantles-gootloader-castlerat-stealc-malware-infrastructure/) — BleepingComputer, 2026-11-12
- [Operation Endgame malware takedown turns up over 6 million stolen logins](https://www.helpnetsecurity.com/2026/11/12/europol-operation-endgame-malware-takedown/) — Help Net Security, 2026-11-12

Tags: malware, law-enforcement, europol, credential-theft, takedown

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev