Three families of password-stealing and ransomware-enabling malware just lost much of their infrastructure. Police from nine countries, coordinating through Europol, seized 235 servers and 257 domains tied to Gootloader, CastleRAT and StealC, and came away with roughly 6.4 million stolen logins belonging to more than 40,000 victims.
The practical question for ordinary users is whether their own details are in that pile. Europol says data linked to CastleRAT infections will be handed to breach-alert services, Have I Been Pwned among them, so entering your email address there is the easiest check. If it turns up, change that password on every site that used it and enable two-step sign-in.
In its announcement, Europol calls this the newest phase of Operation Endgame, a campaign aimed at the services criminals rent to break into networks. Of the totals, StealC lost 102 servers, CastleRAT 120 servers and 39 domains, and Gootloader 14 servers and 218 domains. The StealC strike follows an earlier one in June 2026.
Gootloader spread through poisoned web pages: its operators put fake legal documents on hacked sites, often running WordPress, and anyone who downloaded one got the loader. It then brought in ransomware. Responders cleaned 681 of those sites, and Europol wants WordPress owners to rotate passwords, use multi-factor login and apply updates.
CastleRAT gives an attacker remote control of a machine and was designed to evade detection, Europol says. StealC is the thief of the three: it harvested stored credentials from infected PCs for resale.
That makes two rounds against StealC in 2026, after the first one in June. Anyone who reused a saved password on several sites should treat a breach alert as a prompt to change all of them.
