Notifications
Clear all
Topic starter
14/07/2026 4:23 pm
TL;DR: Operation Endgame disrupted the StealC information-stealer ecosystem, seizing 25.6 million unique credentials from over 385,000 compromised systems and targeting 66 domains and 296 servers, according to Proofpoint and IBM X-Force. The broader lesson is that stolen identities remain an industrialised attack commodity, not just an endpoint problem.
NHIMG editorial — based on content published by Proofpoint: LLMjacking is not applicable; the source analysis covers the StealC disruption and credential theft ecosystem
By the numbers:
- The operation targeted 66 domains and 296 servers associated with both Amadey and StealC.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
Q: What breaks when infostealers collect browser tokens and saved credentials?
A: What breaks is the assumption that compromise stays on the endpoint.
Q: Why do stolen credentials create so much more risk when identity is poorly governed?
A: A stolen credential becomes dangerous when the organisation accepts it as sufficient proof without checking identity state, access scope, or session context.
Q: How should security teams detect credential compromise before it turns into account takeover?
A: Teams should correlate authentication events with post-login behaviour, privilege use, and session context.
Practitioner guidance
- Inventory browser-stored identity artefacts Identify where credentials, cookies, tokens, and autofill data are stored on managed endpoints, then classify which of those artefacts can be reused outside the originating device context.
- Shorten the usefulness window of stolen secrets Prioritise session invalidation, token revocation, and secret rotation for systems that accept browser-based or long-lived authentication material, especially where access can be reused without step-up checks.
- Correlate infostealer indicators with IAM events Feed malware intelligence, C2 indicators, and suspicious authentication telemetry into the same detection path so identity teams can see when harvested credentials begin to appear in live access logs.
What's in the full article
Proofpoint's full analysis covers the operational detail this post intentionally leaves for the source:
- The StealC configuration extraction workflow used to track campaigns, affiliates, and payload delivery patterns.
- The C2 panel vulnerability and how it enabled the disruptive action against StealC infrastructure.
- The emulator approach used to coerce payload URLs from active infrastructure and observe downstream malware delivery.
- The list of payload families observed in the StealC ecosystem, including chained loader and ransomware activity.
👉 Read Proofpoint’s analysis of the StealC disruption and credential theft ecosystem →
StealC disruption and credential theft: what identity teams should notice?
Explore further
14/07/2026 4:31 pm
Infostealer ecosystems are now an identity supply chain, not just a malware class. StealC shows how a single endpoint compromise can generate reusable browser data, tokens, and credentials that move into cloud and SaaS access paths. Once stolen identity artefacts are processed centrally, the attacker does not need to keep the original infection alive. Practitioners should treat exfiltrated credentials as inventory flowing through an underground identity pipeline.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- 23.7% of organisations share secrets through insecure methods such as email or messaging applications, which keeps the credential supply chain easy to exploit.
A question worth separating out:
Q: What should organisations do immediately after infostealer exposure is suspected?
A: Revoke or rotate any exposed secrets, invalidate active sessions, and review privileged or third-party access paths first. Then check whether those credentials were used against cloud, SaaS, or admin services, because a stolen token often becomes a broader access path before the original malware is contained.
👉 Read our full editorial: Operation Endgame’s StealC disruption and NHI credential risk
