Amadey and StealC Malware Infrastructure Disruption

No Single CVE
Malware Infrastructure Disruption
Loader / Infostealer Operation

Overview

International law enforcement agencies and cybersecurity companies disrupted infrastructure linked to the Amadey malware loader and StealC infostealer malware. The operation targeted command-and-control servers, malicious domains, and backend systems used to infect victims and steal credentials and other sensitive information.

Amadey functioned as a malware loader capable of downloading and executing additional payloads, while StealC operated as an information stealer focused on browser credentials, session data, wallets, and other account secrets. Public reporting indicates that the disruption was part of Operation Endgame and aimed at weakening a broader cybercrime ecosystem that supports credential theft, fraud, and ransomware operations.

Technical Specifications

Attribute	Details
CVE ID	No single CVE
Vulnerability Type	Malware-as-a-Service / Loader and Infostealer infrastructure
CVSS Score	Not applicable
Attack Vector	Network / User execution via phishing, malicious downloads, exploit delivery, and compromised websites
Authentication	None
Complexity	Medium
User Interaction	Often Required
Affected Versions	Broad victim exposure across Windows endpoints and environments impacted by Amadey and StealC delivery chains

Affected Products

• End-user Windows systems infected through phishing, trojanized software, exploit kits, or compromised websites
• Browsers storing credentials, cookies, autofill data, and session tokens
• Cryptocurrency wallet users and systems with wallet extensions or applications
• Enterprise environments where stolen VPN, FTP, messaging, and cloud credentials can be reused
• Organizations exposed to follow-on ransomware, fraud, and account-takeover activity

Attack Scenario

1. A victim receives a phishing email, visits a compromised website, or downloads trojanized software.
2. The Amadey loader executes on the system and establishes persistence.
3. Amadey contacts attacker-controlled command-and-control infrastructure and downloads additional payloads.
4. StealC or another follow-on payload is deployed to harvest browser credentials, cookies, wallet data, messaging tokens, and other sensitive information.
5. The stolen data is exfiltrated to attacker infrastructure and organized for resale, reuse, or further intrusion activity.
6. Threat actors use the harvested data for account takeover, financial fraud, ransomware access operations, or lateral movement inside enterprise environments.

Impact Assessment

Integrity

• Attackers can deploy additional payloads after initial compromise and alter endpoint behavior.
• Persistence mechanisms may allow recurring malicious activity on infected systems.
• Stolen access can enable unauthorized changes across enterprise, cloud, or messaging platforms.

Confidentiality

• Browser credentials, cookies, cryptocurrency wallet data, FTP/VPN credentials, and messaging tokens may be stolen.
• Compromised credentials can expose corporate accounts, cloud services, and sensitive internal data.
• Large-scale credential theft increases downstream risk of espionage, fraud, and identity abuse.

Availability

• Infections can serve as a precursor to ransomware or broader enterprise disruption.
• Recovery efforts may require credential resets, endpoint rebuilding, and coordinated incident response.
• Compromised internal access can contribute to lateral movement and operational instability.

Mitigation Strategies

Immediate Actions

• Reset compromised credentials immediately and invalidate active sessions where possible.
• Enforce phishing-resistant MFA for administrative, remote-access, and cloud accounts.
• Block known malicious domains, IPs, and indicators associated with Amadey and StealC campaigns.

Short-term Measures

• Deploy or tune EDR/XDR monitoring to identify infostealer and loader behavior.
• Restrict script execution, macro abuse, and suspicious PowerShell or command-shell activity.
• Keep operating systems, browsers, and endpoint software updated to reduce exploit and malware delivery risk.

Monitoring & Detection

• Monitor suspicious outbound traffic to known or newly observed command-and-control destinations.
• Hunt for scheduled tasks, registry persistence, credential dumping behavior, and unusual browser data access.
• Use network segmentation and least-privilege access controls to limit blast radius after endpoint compromise.

Resources and References

Official Documentation

• The Hacker News - Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered
• SecurityWeek - Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware
• Infosecurity Magazine - Operation Endgame Takes Down StealC and Amadey Infostealers
• Microsoft Security Blog - StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them

---

Last Updated: June 25, 2026