Police Seize 6.4 Million Logins in Malware Takedown

An international police operation seized about 6.4 million stolen login credentials connected to more than 40,000 victims. The takedown disrupted three malware tools, but households should still act because criminals may retain stolen passwords and infected computers can continue sending them new ones.

What happened

Police took down infrastructure used by Gootloader, CastleRAT and StealC, according to The Hacker News. Investigators seized 235 servers and 257 domains across the operation, which was supported by Europol.

Each malware family served a different purpose. Gootloader downloaded additional malicious software, including ransomware. It often reached victims through fake legal documents placed on compromised websites and promoted through manipulated search results. The U.S. Justice Department said Gootloader was involved in ransomware attacks against at least 44 U.S. victims, causing approximately $28.8 million in losses.

CastleRAT let attackers remotely control infected computers. StealC collected passwords and other login credentials that criminals could sell or use. Police had previously targeted StealC in June, but its operators rebuilt their infrastructure before this latest action.

Authorities also cleaned Gootloader from 681 compromised websites. Danish investigators believe attackers used stolen passwords to enter some sites, install backdoors and maintain access.

Who is affected

Anyone who downloaded a fake document from a compromised website or had a computer infected by one of these malware families could be affected. Gootloader alone has infected at least 25,000 computers worldwide since 2018, according to the Justice Department figure cited by The Hacker News. German investigators gave a much higher worldwide estimate.

Dutch police have added data stolen by CastleRAT to their Check your hack service. More records will be added in the coming weeks. The seized information is also being shared with Have I Been Pwned and the Shadowserver Foundation.

A police seizure does not make stolen credentials safe again. Authorities warned that criminals may still have copies, and malware left on a computer may continue stealing passwords.

What to do now

1. Check each household email address with the Dutch police’s Check your hack service. Open it through the source report above instead of following a link in an unexpected message. The service sends an email within a few minutes only when it finds a match.

2. Ignore emails claiming to be from police that ask you to click a link to check your exposure. Dutch police said those messages are fake and that their legitimate notifications do not contain links.

3. If your address is found, follow the police-provided malware removal instructions before entering new passwords on the affected computer. You can also run a full scan with your installed security software and complete any recommended cleanup.

4. After the computer is clean, replace passwords for important accounts, starting with email, banking, shopping and cloud storage. Change every other account where the same password was reused.

A family password manager can generate and share unique replacements so one stolen password does not unlock several accounts.

5. Turn on two-factor authentication or a passkey wherever an account offers it. CyberSec24’s family passkey guide explains how to move beyond password-only sign-ins.

6. Small-office WordPress owners should change administrator passwords and check their sites for unfamiliar accounts, files or backdoors. Investigators found that stolen passwords were used to compromise websites involved in this campaign.