Amadey and StealC network dismantled: 27 million stolen passwords recovered

An international police operation coordinated by Europol has dealt a heavy blow to two of the tools most used by cybercriminals to steal information: Amadey and StealC. In mid-June 2026, the authorities, with the support of security companies, disconnected hundreds of servers and seized dozens of domains. The most striking result for users and businesses is that around 27 million credentials that had been stolen from infected computers have been recovered.

To understand why it matters, it helps to know how these threats work. Amadey acts as a “gateway” that paves the way for installing more malicious software. StealC belongs to the infostealer family: it scans the computer for saved passwords, session data and other sensitive files to send them to the criminals. Most worrying of all, both were sold as a service, so any criminal without much expertise could rent them. These stolen credentials are then often used for bank fraud and as a prelude to ransomware attacks.