Europol Disrupts StealC, Gootloader and CastleRAT, Uncovers 6.4 Million Stolen Credential Records

International law enforcement agencies have disrupted three major malware operations used by cybercriminals to steal sensitive information, gain unauthorized access to computers, and support ransomware attacks. On November 12, 2026, Europol announced that authorities had taken action against infrastructure supporting StealC, Gootloader, and CastleRAT as part of Operation Endgame, a coordinated international effort targeting cybercrime services.

The operation involved law enforcement agencies from nine countries and resulted in action against 235 servers and 257 domains associated with the malware networks. Investigators also recovered approximately 6.4 million stolen credential records and related victim data, which can help authorities identify and notify affected individuals. Germany's Federal Criminal Police Office reported that the recovered credentials were associated with more than 40,000 victims.

For small businesses, the operation is an important law enforcement success. It also highlights an ongoing problem: credentials stolen by infostealer malware can remain dangerous even after the infrastructure used to collect them has been dismantled.

What happened during Operation Endgame?

Operation Endgame is an international law enforcement initiative focused on disrupting the malware networks that help criminals gain initial access to computers and business systems. Rather than targeting only individual ransomware groups, it goes after the tools and infrastructure that enable other cybercriminals to launch attacks. Between November 9 and November 11, 2026, participating authorities carried out coordinated actions against three malware operations, and the results were announced on November 12.

Operation Endgame: November 2026 results

• Gootloader: 14 servers and 218 domains disrupted. Primary threat: malware delivery and initial access.
• CastleRAT: 120 servers and 39 domains disrupted. Primary threat: unauthorized remote computer access.
• StealC: 102 servers disrupted. Primary threat: credential and information theft.

Europol reported 235 servers and 257 domains in its overall operational figures. The per-malware figures describe the infrastructure targeted for each operation and should not be treated as an independently additive total. Authorities also reported that 681 compromised websites associated with Gootloader distribution were remediated. The operation involved agencies from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom, and the United States, with Europol and Eurojust coordinating the international effort.

What is StealC malware?

StealC is a type of malicious software known as an infostealer. Infostealers are designed to collect sensitive information from infected computers and transmit it to attackers. Depending on the version and what is present on a device, stolen data can include saved browser passwords, authentication information, cryptocurrency wallet data, and other sensitive records. StealC has also been used to deliver additional malicious software, which makes it dangerous for both individuals and businesses.

For example, an employee might unknowingly run malicious software while downloading an application or opening a deceptive file. If an infostealer collects credentials from that computer, attackers could try to use them to reach business email, cloud applications, or other services. Whether those attempts succeed depends on the credentials obtained, their validity, and the protections on the accounts, which is why stolen session cookies and reused passwords both matter here.

Why StealC was targeted again

StealC had already been the subject of law enforcement action in June 2026. Investigators reported that the criminals adapted their infrastructure and resumed operations, and the November action targeted this rebuilt infrastructure. That is an important reminder that disrupting a criminal operation does not necessarily stop its operators from returning. They may move to new hosting providers, register new domains, or adopt different malware tools, so businesses should keep protecting accounts even when authorities announce successful takedowns.

What is Gootloader malware?

Gootloader is malware designed to infect computers and deliver additional malicious software, and it has been active since roughly 2020. One of its established techniques is manipulating search results so malicious websites appear relevant to legitimate searches, a method known as SEO poisoning. An employee searching for a legal document or business template might land on a compromised website offering what looks like a legitimate download, then run malicious code instead of receiving the expected file. Gootloader can then help attackers establish access to the computer and deploy further malware, and in some attacks that access has supported ransomware operations.

Why Gootloader matters to small businesses

Employees frequently search online for invoices, contracts, templates, software utilities, and technical instructions. A malicious search result can look convincing, especially when it is hosted on a previously legitimate website. Businesses should train staff to evaluate download sources carefully and avoid running unexpected scripts or executable files. The November operation disrupted 218 Gootloader-related domains and remediated 681 compromised websites, which reduces access to identified malicious infrastructure but does not guarantee every infected computer has been cleaned.

What is CastleRAT?

CastleRAT is a remote access Trojan, commonly called a RAT. A remote access Trojan lets an attacker control an infected computer from another location. Unlike legitimate remote-support software, a malicious RAT operates without authorization. Attackers may use that access to run commands, collect information, install additional malware, or maintain a foothold in compromised systems. CastleRAT emerged in 2025 and has been linked to criminal activity involving ransomware and unauthorized access, and Europol reported that it was designed with capabilities that made detection difficult. During the November operation, authorities disrupted 120 servers and 39 domains associated with CastleRAT and produced victim information to support notifications.

Why remote access malware is dangerous

A computer infected with remote access malware may remain vulnerable even after a user changes an account password. If an attacker still controls the machine, newly entered credentials or other sensitive information could be exposed again. That is why businesses should not rely only on password resets when a malware infection is suspected. A qualified security professional should assess the affected device, contain the infection, determine the extent of unauthorized activity, and establish whether the computer can safely return to service. Our malware incident response steps walk through that sequence.

Authorities recover approximately 6.4 million stolen credential records

One of the most significant findings was the recovery of approximately 6.4 million stolen credential records and related victim information. Germany's Federal Criminal Police Office reported that the recovered access credentials were associated with more than 40,000 victims. These are different measurements. The 6.4 million figure should not be read as 6.4 million unique individuals or 6.4 million newly compromised accounts, because a single victim can have many credentials or records collected by malware, and some may be outdated, duplicated, or no longer valid. Even so, the scale shows how much sensitive information criminal malware infrastructure can accumulate.

What happens to the recovered information?

Europol announced that victim information would be made available through established notification and cybersecurity platforms, including Have I Been Pwned, DIVD, CheckJeHack, NoMoreLeaks, Sekoia, the Shadowserver Foundation, and the Netherlands National Cyber Security Centre. These services have different audiences and processes: some help individuals check whether their information appears in known breaches, while others assist organizations, network operators, and security teams with identifying affected systems. Not every recovered record will be immediately searchable through every platform. Individuals and businesses should use official services and avoid any website claiming to offer unrestricted access to the seized criminal databases.

Does the takedown mean stolen passwords are now safe?

No, and this is the most important lesson from the operation. When attackers steal credentials, they may copy the information, sell it, or share it with other criminals. Disabling the original collection server does not automatically invalidate those credentials or remove every copy already distributed. If an infostealer captured an employee's business email password before the takedown, that password could still be valid afterward, and the risk remains until the affected account is properly secured. The same principle applies to authentication tokens and other sensitive information, though the right remediation depends on the credential type. A law enforcement operation can interrupt criminal activity and support victim identification, but affected organizations must still act.

How can businesses check for stolen credentials?

Businesses should use reputable credential-exposure monitoring services and review official notifications from law enforcement or trusted security providers. A known exposure finding can indicate that an employee's account information appeared in a breach or infostealer dataset. However, not every stolen credential becomes publicly available or appears immediately in a monitoring service, so a clean result does not guarantee an account has never been compromised. Businesses should also investigate unusual authentication activity, unexpected password resets, suspicious account changes, and any reports of malware infection. You can start by checking whether your business email has appeared in a data breach.

What small businesses should do after this announcement

The Europol takedown is a good moment to review your credential security and malware response procedures.

1. Review known credential exposures. Check business email accounts and other important logins against reputable, supported exposure intelligence, prioritizing active employee accounts and privileged users.
2. Replace compromised passwords. When a credential is confirmed or reasonably suspected to be compromised, replace it with a unique, strong password from a trusted device, and change it anywhere else it was reused. See what to do when a password shows up on the dark web.
3. Enable multifactor authentication. Require MFA for business email, remote access, cloud apps, and administrative accounts, preferring phishing-resistant methods such as passkeys or hardware keys. MFA reduces account-takeover risk but does not eliminate every threat involving stolen sessions or compromised devices.
4. Investigate potentially infected computers. If a device may have been infected with StealC, Gootloader, CastleRAT, or related malware, involve a qualified security professional. Changing passwords alone does not remove malware.
5. Review account activity. Investigate unfamiliar sign-ins, unexpected authentication prompts, unusual permissions, and unauthorized changes, and revoke active sessions or suspicious connected apps where appropriate.
6. Update software and browsers. Keep operating systems, browsers, security software, and business applications patched, and remove unsupported applications.
7. Restrict administrative access. Apply least privilege, and avoid using administrative accounts for routine browsing, downloads, or email.
8. Educate employees about malicious downloads. Teach staff to recognize suspicious search results, fake document downloads, unexpected executables, and fraudulent installers, and to report unusual computer behavior promptly.

Why healthcare organizations should pay attention

Healthcare organizations depend on business applications containing sensitive patient, billing, scheduling, and operational information, and employees often reach these systems through web browsers and connected apps. If an infostealer compromises a workstation, it may collect saved login information for those applications, creating risks of unauthorized access, account misuse, and exposure of sensitive information.

The Europol announcement does not establish that a particular healthcare provider or patient database was compromised. Still, healthcare practices should treat infostealer exposure as part of their broader risk management, with strong authentication, managed endpoint protection, limited administrative privileges, regular account reviews, and clear procedures for responding to known exposed credentials. Our guide to dark web monitoring for healthcare and HIPAA covers this in more depth.

How GuardPilot supports credential exposure monitoring

The Operation Endgame takedown demonstrates why businesses need visibility into known stolen login credentials. GuardPilot is the AI Incident Response Platform for Credential Exposure. It helps individuals and small businesses identify known exposed login credentials appearing in supported breach records, infostealer data, and dark-web sources, and when a relevant finding surfaces it does more than hand you a list: its AI explains the exposure in plain English and guides you through the appropriate next steps, then reminds you until the incident is resolved.

The boundary matters too. GuardPilot does not detect StealC, Gootloader, or CastleRAT running on a computer. It does not perform endpoint investigations, remove malware, inspect live authentication sessions, or determine whether an organization's devices were part of the seized infrastructure. GuardPilot also cannot guarantee that the newly recovered Operation Endgame records are available through its supported intelligence sources, and a clean result does not mean an account or computer is free from compromise. Combine credential-exposure awareness with endpoint protection, strong authentication, secure backups, and incident response. Concerned about known exposed business credentials? Check your credential exposure.

Frequently asked questions

What happened during Operation Endgame in November 2026?

Europol and international partners disrupted infrastructure associated with StealC, Gootloader, and CastleRAT, acting against 235 servers and 257 domains and recovering millions of stolen credential records.

Were 6.4 million people hacked?

Not necessarily. The figure refers to approximately 6.4 million credential records and related victim data. German authorities associated the recovered access credentials with more than 40,000 victims.

What does StealC malware steal?

StealC is designed to collect sensitive information, including saved passwords, access data, and other information available on infected computers.

Is Gootloader ransomware?

Gootloader is primarily a malware loader. It can deliver additional malicious software and has been associated with attacks that eventually deploy ransomware.

What does CastleRAT do?

CastleRAT is a remote access Trojan that lets attackers control infected computers remotely and potentially carry out additional malicious activity.

Are stolen passwords safe after a malware takedown?

No. Credentials copied or distributed before the takedown may remain usable until they are replaced or invalidated.

How can I check whether my credentials were exposed?

Use reputable breach-notification and credential-exposure services, including the official resources identified by Europol. Availability depends on which datasets each service has received and processed.

Can GuardPilot detect StealC infections?

No. GuardPilot monitors supported known credential exposures. It does not detect malware infections or perform device forensics.

The takeaway

The November 2026 Operation Endgame action is a significant disruption of criminal infrastructure supporting malware distribution, remote access, and credential theft, with authorities acting against hundreds of servers and domains and recovering roughly 6.4 million stolen credential records associated with more than 40,000 victims. But the disruption does not erase stolen information or automatically secure affected accounts. For small businesses and healthcare organizations, the message is clear: protecting credentials requires continuous attention, even when law enforcement dismantles criminal infrastructure. Investigate known exposures, replace compromised credentials, protect accounts with MFA, and address suspected malware infections through proper incident response, with credential-exposure monitoring as one useful layer of that broader strategy.