Microsoft and Europol Pull Off First-Ever Dual Cybercrime Tool Takedown

Microsoft and Europol dismantle Amadey and StealC hacking tools, using AI and the RICO Act, protecting against malware and data theft.

By Content Team

Jun 25, 2026

ON THIS PAGE

Microsoft and law enforcement pulled off something new this week — dismantling two criminal hacking tools simultaneously instead of one at a time. Working under Europol's Operation Endgame alongside ESET, IBM X-Force, Proofpoint, BitSight, Lumen and police forces in Germany, the Netherlands and Denmark, they took down more than 200 command-and-control servers linked to Amadey and StealC. Europol puts the wider operation's haul at 326 servers.

The two tools are commonly used together: Amadey delivers malware, StealC steals passwords, crypto wallets and personal data. In just the first week of May, they infected over 140,000 computers globally. The operation also recovered roughly 27 million stolen credentials.

Microsoft says its Copilot AI helped lawyers connect both threats as a single criminal conspiracy under the RICO Act — a strategy it plans to expand.

Source: CyberScoop

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?