Europol says this week’s Operation Endgame takedown turned up 6.4 million sets of stolen victim data. What victims can actually check today is about 180,000 email addresses, all of them lifted by a single malware strain.
Have I Been Pwned has loaded 179,700 email addresses and 893,000 unique passwords taken from computers infected with CastleRAT, a remote access trojan. It’s the only victim data from the operation that has surfaced publicly so far, and it is the smallest of the five Endgame datasets HIBP has published since 2024.
On Thursday, the EU’s collective law enforcement bod reported a coordinated crackdown resulted in the removal of 257 domains and 235 servers running the Gootloader, CastleRAT, and StealC malware operations.
“During the action, over 6 million victim credentials were identified in the criminal infrastructure owned by the cybercriminals and seized by the authorities during this week,” Europol said.
This isn’t a Europe-only problem. The US Justice Department, which ran its own Gootloader action alongside Endgame, says the malware has infected at least 25,000 computers worldwide since 2018. It ties Gootloader to ransomware attacks on at least 44 US victims and about $28.8 million in reported losses.
The targets reached into the Pentagon’s orbit. The Defense Criminal Investigative Service said the attacks hit the Department of War and the Defense Industrial Base. The case is being prosecuted out of the District of Colorado.
Neither agency has said how much of the 6.4 million victim datasets belongs to US people or companies.
The WordPress Connection
Gootloader’s delivery network ran through hacked websites. DOJ says the malware was scrubbed from more than 100 servers, including compromised WordPress sites. Europol says Gootloader’s operators planted fake legal documents on those sites, and searchers looking for contracts and templates downloaded the malware instead.
Researchers who have tracked the loader say it doesn’t need anything fancy. Huntress found that late-2025 Gootloader campaigns abused WordPress’s own comment-submission endpoint to serve encrypted payloads from compromised sites, and concluded that the operators “don’t need cutting-edge exploits.” Neither Huntress nor the agencies has said how the sites were compromised in the first place.
Europol’s advice to WordPress users is basic hygiene. It recommends users update credentials, enable multi-factor authentication, and patch. And there has been plenty to patch.
CISA has added four WordPress core flaws to its Known Exploited Vulnerabilities catalog since July. That includes the “wp2shell” chain (CVE-2026-63030 and CVE-2026-60137) and, as of Nov. 3, CVE-2026-119977. Plugins are a bigger exposure. Attackers began exploiting a critical file-upload flaw in Elementor Pro (CVE-2026-32475), a plugin on more than 6 million sites, the same day it was patched in August.
None of those bugs has been linked to Gootloader.
Three Tools, One Business Model
Those 257 domains and 235 servers did more than run the malware. They were also where the loot was kept. Europol says the stolen credentials were found sitting on the seized infrastructure.
“The suspects were using these credentials, stolen from the victims after they infected them, to sell them and later be used for other cyber-attacks such as ransomware,” Europol said.
The three were taken down together, but they are separate malware families, run by different crews and sold or rented to other criminals.
Gootloader is the loader, the malware that gets the first foothold. Its operators plant fake legal documents and contract templates on hacked, legitimate WordPress sites, then rig search results so those pages rank near the top of Google for oddly specific queries.
Sophos once found a Canadian neonatal practice ranking first for a real-estate agreement. An established site with a real search history gets a top result that a brand-new criminal domain never would. DOJ says the operators then used the botnet to infect more machines and sold access to them to ransomware crews.
Huntress says Gootloader’s operator is tracked by Microsoft as Storm-0494. It hands infected networks to Vanilla Tempest, a ransomware group whose attacks after a Gootloader infection have commonly involved Rhysida.
CastleRAT, as its name would suggest, is the remote access tool. Recorded Future first documented it in September 2025 and ties it to a group it originally called TAG-150 and now tracks as GrayBravo. Its infections usually start with fake-CAPTCHA “ClickFix” lures or bogus GitHub repositories, not Gootloader.
StealC does the dirty work of harvesting passwords and other login data. It’s sold off the shelf. Sekoia spotted it in early 2023, when a developer using the handle “Plymouth” began selling it on Russian-language cybercrime forums, so the people running StealC campaigns may have nothing to do with its author.
Neither Europol nor DOJ named anyone behind the three operations, said where they are based, or announced arrests.
What is clear is that hacked WordPress sites get reused. Australia’s cyber agency warned in July that attackers were mass-scanning CMS plugins for known, already-patched flaws to plant webshells.
Plugins are a bigger exposure risk, and critical plugin flaws are often weaponized within hours of disclosure.
The Numbers Don’t Line Up
The two agencies’ accounts of the operation don’t fully match, and neither explains the gaps. Europol’s per-malware breakdown lists 14 Gootloader servers, 120 CastleRAT servers and 102 StealC servers. That adds up to 236, one more than its stated total of 235. Its domain counts, 218 for Gootloader and 39 for CastleRAT, account for all 257 seized domains and leave none for StealC.
The Gootloader numbers differ between the two agencies too. DOJ says the malware was scrubbed from “over 100” servers, including compromised WordPress sites. Europol counts 14 servers taken down and 681 infected websites cleaned up. Even the guest list varies. DOJ thanks France’s Paris cybercrime unit and the Australian Federal Police, neither of which appears among the nine countries Europol credited, and it doesn’t mention Bulgaria, Moldova or Poland.
Then there’s the gap at the top of this story. Europol hasn’t said whether any of the Gootloader or StealC victim data will reach notification services, or how much of the 6.4 million involves US victims. Security Point Break has asked Europol to clarify the figures and will update this story when it responds.
Endgame by the Numbers
Operation Endgame has now run five rounds that produced data for HIBP. The first two, in May 2024 and May 2025, each put more than 15 million email addresses into the service. The last three together total under 6.5 million.
StealC is also a repeat target. It was hit in Endgame’s June round alongside Amadey and SocGholish.
Who Did What?
While Europol did not give precise locations of the seized servers or announce any arrests, it said private-sector partners helped identify, take down, seize, and block the criminal infrastructure.
In the US, DOJ credited the Defense Criminal Investigative Service, the FBI’s Denver Field Office (Go Avs), the Department of the Army Criminal Investigation Division, the Criminal Division’s Computer Crime and Intellectual Property Section, and the US Attorney’s Office for the District of Colorado. The action fits a broader FBI push to go after the services cybercriminals rely on.
