Operation ENDGAME: Europol Secures 6.4 Million Victim Datasets

Operation ENDGAME Gootloader StealC 2026 disrupted infrastructure for three malware toolkits, Europol said on 12 November. Its headline counts 6.4 million victim datasets secured, while the article body describes more than 6 million victim credentials found in seized criminal infrastructure. Those labels describe data, not a verified number of distinct people or separate breaches.

Europol reports action against 235 servers and 257 domains across Gootloader, CastleRAT and StealC. The operation also remediated 681 infected websites associated with Gootloader. These measures interrupt different parts of a criminal service chain; none alone shows how many victims have recovered or how many infections remain.

• 6.4 millionVictim datasets in Europol headlineSource: Europol, 12 November 2026
• 235Servers actioned across the operationSource: Europol, 12 November 2026
• 257Domains actioned across the operationSource: Europol, 12 November 2026
• 681Gootloader infected websites remediatedSource: Europol, 12 November 2026

Operation ENDGAME Gootloader StealC 2026: What the Counts Describe

The 6.4 million figure comes from Europol’s headline, which calls the material victim datasets. Its body uses a different unit, saying investigators identified more than 6 million victim credentials inside seized infrastructure. Europol says suspects stole credentials after infections, then used them for sale and possible later attacks.

The statement does not give a deduplicated person count, a distinct account count or a confirmed breach count. One person could have several credentials, while one dataset could contain several records. Treating the headline as 6.4 million unique victims would therefore overstate what the public statement establishes.

The infrastructure numbers also require care. Europol gives 235 servers and 257 domains for the coordinated action involving law enforcement and private parties. Its toolkit descriptions separately list servers and domains taken down, seized or dismantled, but do not explain whether those lists overlap.

Those toolkit figures should not be added to the operation totals. They use different action verbs and may reflect different accounting boundaries. The 681 remediated websites form another measure: compromised sites cleaned during the Gootloader response, rather than additional domains seized.

For teams handling harmful online infrastructure outside a police operation, a takedown service is a separate operational route. Europol’s seizure figures describe this particular international action, so they are not a benchmark for a commercial takedown request.

Three Toolkits, Three Places to Look

Europol identifies Gootloader as a loader distributed through fake legal documents on compromised websites. People who downloaded the documents could become infected, including after visiting hacked WordPress sites. The loader could open access for later crimes, including ransomware installation, according to the agency.

For Gootloader, Europol lists 14 servers and 218 domains taken down, plus the 681 infected websites remediated. A site owner should distinguish a compromised delivery website from a device infected after a download. Cleaning the website does not establish that every endpoint reached by it is clean.

CastleRAT is a remote access trojan that lets an attacker control an infected computer from a distance, Europol says. The agency associates its use with encrypted data and disrupted IT systems at affected organisations. It reports 120 servers and 39 domains seized, with victim data shared for alerts.

StealC is described as a stealer with a loader function. Europol says it gathers passwords, stored access data and digital identities from compromised computers for later illicit use. The agency reports 102 servers dismantled and links this action to its June 2026 operation.

The three descriptions cover delivery, remote control and credential theft, but Europol does not say every case followed one combined sequence. Defenders should investigate each mechanism on its own evidence. Our malware loader explanation gives context for the first stage, while our leaked credentials overview covers the account risk after theft.

What a Defender Can Check After the Disruption

Europol says victim data will be shared through named notification platforms and that WordPress users should update credentials, enable multifactor authentication and patch vulnerabilities. Those are the agency’s stated actions. The sequence below is our practical reading of its three toolkit descriptions, not a claim that Europol prescribed each check.

• Check notificationsConfirm whether an authorised notification channel identifies your organisation or accounts.
• Review website integrityInvestigate unauthorised changes on WordPress sites and preserve relevant logs.
• Scope infected endpointsExamine devices that downloaded suspect legal documents or show remote-control activity.
• Contain exposed accountsReset affected credentials, revoke sessions and enforce multifactor authentication.
• Verify recoveryCheck the cleaned website, rebuilt device and replacement credentials before closing the case.

A notification should start a scoped investigation rather than an assumption that every listed account was compromised at once. The relevant question is which credential belongs to which system and whether it remained valid. Our leaked credential response guide provides a broader sequence for account owners.

Website owners can review change histories, administrator access and unexpected pages around the suspected delivery period. Endpoint teams can correlate download histories with device alerts and later sign-in events. If remote access or credential theft is suspected, preserve evidence before rebuilding devices or rotating accounts.

The public statement does not provide a victim-level timeline or a list of affected organisations. It also does not tie each recovered credential to a named toolkit. That leaves incident teams to validate local exposure through their own logs and any notification they receive.

Why the Brandefense Blackhole Count Has a Narrow Meaning

Brandefense Blackhole counted 31,899 dark-chat posts matching the broad term “Operation” from 14 August through 12 November 2026. The measured unit is posts returned by that query, not ENDGAME posts, accounts, infected devices or victims. The generic term makes this count unsuitable as evidence of discussion about the Europol action.

The count is a separate observation from Europol’s seized data and infrastructure figures. It cannot be added to them or used to confirm the incident. Europol’s statement supplies the evidence for the operation; the Blackhole query only illustrates why a broad keyword count needs a relevance check.

Method and Limits

This article reads Europol’s 12 November public statement and the Brandefense Blackhole aggregate supplied for 14 August to 12 November. The Europol counts are action and data categories with distinct units. We have kept its headline dataset wording separate from its body wording about credentials.

We did not infer a unique victim count from either phrase. We also did not sum toolkit infrastructure lines, because Europol does not establish that the components are disjoint. The operational checks are our defensive interpretation of the disclosed malware roles and the agency’s WordPress advice.

A law enforcement takedown can reduce criminal infrastructure while stolen credentials remain useful elsewhere. Teams receiving a notification can use the law enforcement takedown overview to separate the infrastructure result from their own account recovery work.