Operation Endgame takes down 326 servers behind three malware families

Europol and Eurojust announced on 24 June 2026 a new phase of Operation Endgame, the recurring campaign against the infrastructure that delivers malware. During an action week from 15 to 19 June, authorities from Germany, Belgium, Denmark, France, the Netherlands, the United Kingdom, the United States and Canada, with Europol, neutralised 326 servers and 142 domains and recovered 27 million compromised data sets.

The three families targeted play distinct roles in the criminal supply chain. Eurojust describes SocGholish as gaining access through fake browser updates on compromised websites, access then used for other crimes such as ransomware; StealC as a tool for extracting passwords and identities; and Amadey as spread by phishing and able to deliver further malware and retrieve data. Earlier phases took place in May 2024, May 2025 and November 2025.

Why it matters The credentials recovered here are the raw material of the access-broker market: a stealer log sold once can be resold and reused for months. Takedowns remove infrastructure, not the data already traded, so the practical follow-up for an organisation is to check whether its domains appear in the recovered sets and in the listings that outlive the servers.