Global cyber strike disrupts SocGholish, Amadey, and StealC malware networks

June 25, 2026 - British Columbia, British Columbia
From: Federal Policing Pacific Region

Content

Congratulations to our international policing partners as we wrap up another successful Operation Endgame. The RCMP’s Federal Policing Pacific Region (FPPR) Cybercrime Investigation Team – Vancouver (CIT-V) was the Canadian lead on this investigation working with our domestic and international partners to deliver a major blow to a cybercriminal network, SocGholish, during a joint global action week that cleaned infected WordPress sites and notified victims. The CIT-V dedicated coders, analysts, investigators and project managers to the international project that worked to target the malware framework that tricks users into downloading malicious files by masquerading as legitimate computer updates. 

Now, the final numbers are in: Crypto criminal assets valued at over $66 million CDN (40 million EUR) were also identified, flagged, and thereby restricted from use. Furthermore, as many as 27 million stolen login credentials were recovered as part of the operation. During this enforcement, 36 servers and 142 domains were actioned by law enforcement, disabling the malware’s distribution network. Approximately 15,000 websites were remediated to ensure they are deemed secure.

Participating countries included the United Kingdom, France, Denmark, Germany, Netherlands, Australia, Belgium, United States, Europol, and Eeurojust, including the following agencies: 

• Federal Bureau of Investigation (FBI), United States of America
• National Crime Agency (NCA), United Kingdom
• Danish Police (Politi), Denmark
• Federal Criminal Police Office (BKA), Germany
• National High Tech Crime Unit (NHCTU), Netherlands

The collaboration between law enforcement and private parties has increased the difficulty for cybercriminals, making it harder to succeed in criminal activity. 

Contacts