VULNpocalypse
Breaches and incidentsBriefChecked against a primary source

Operation Endgame: SocGholish, Amadey and StealC disrupted

Europol-coordinated action: 326 servers and 142 domains actioned, over EUR 41M (about $47M) in crypto flagged and restricted, 27M stolen credentials...

Disclosed

What happened

  • Europol-coordinated action: 326 servers and 142 domains actioned, over EUR 41M (about $47M) in crypto flagged and restricted, 27M stolen credentials recovered, 14,971 infected (mostly WordPress) sites remediated. Microsoft says Amadey and StealC were linked to 140,000+ infected computers in the first two weeks of May 2026. No arrests listed.
  • Technique: SocGholish fake browser updates on hacked sites (linked to Evil Corp in reporting), Amadey loader, StealC infostealer.
  • Attribution: law enforcement.

Sources

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.