$47 Million in Illicit Crypto Seized as Europol Cracks Down on Global Cybercrime Networks
On Wednesday, Europol announced the completion of Operation Endgame, an international action that dismantled infrastructure supporting global ‘cybercrime-as-a-service’ malware campaigns.
The operation involved law enforcement from Canada, Denmark, Germany, the Netherlands, the United Kingdom, the United States, and companies like Microsoft. Authorities took action against 326 servers and 142 domains, effectively crippling these networks. Europol disclosed that $47 million in crypto assets of ‘criminal origin’ were seized, and over 27 million stolen credentials were recovered.
The operation targeted three key malware platforms that provide services to other cybercriminals. SocGholish distributed fake browser updates through compromised WordPress sites and was used as a channel for ransomware. StealC focused on extracting passwords, accessing data, and digital identities from victims’ devices, making them available for illicit use. Amadey spread through phishing campaigns and served dual purposes: introducing other malware into compromised systems and retrieving sensitive data.
Microsoft found that Amadey and StealC were linked to over 140,000 infections during the first two weeks of May, while SocGholish infected 14,971 sites. Europol noted that Operation Endgame marked a shift in strategy, emphasizing that instead of focusing solely on individual threats, authorities disrupted the entire chain that allows cyberattacks to scale. This operation follows the takedown of Tycoon 2FA, a major phishing platform used to bypass multi-factor authentication.