Australia's cyber agency broke into Amadey and cut off 180,000 hijacked computers

Key points

• The Australian Signals Directorate (ASD), Australia's electronic spy agency, broke into the backend of an Amadey malware operation and severed its link to roughly 180,000 infected computers worldwide, including machines in Australia.
• Amadey is a malware delivery service that criminals rent to drop other tools onto victim machines, most often the StealC password stealer.
• Microsoft's security team, in a June 2026 writeup on StealC and Amadey, says infostealers now feed much of the ransomware supply chain by harvesting session tokens and passwords from everyday PCs.
• Australia's Annual Cyber Threat Report 2025-26 frames the takedown as part of a shift toward active disruption of criminal infrastructure.
• Cutting a controller offline doesn't clean infected machines, and stolen credentials already sold to other criminals remain usable.

Australia's main cyber-intelligence agency has pulled the plug on one arm of a sprawling malware operation, and the detail that matters isn't the raid itself but the timing.

The Australian Signals Directorate said its operators got inside the backend of a criminal running Amadey, a piece of malware that acts as a delivery van for other hacking tools. Once inside, ASD cut the controller's link to about 180,000 infected computers around the world. Some of those machines are in Australia. The operation was first reported by The Hacker News.

Amadey itself isn't new. It's rented out on criminal forums as a service, in the same way a small business might rent a mailing list. A buyer pays, pushes Amadey onto victim PCs through fake software downloads or booby-trapped email attachments, then uses it to install whatever they actually want to run. More often than not, that payload is StealC, an infostealer that quietly copies saved passwords, authentication cookies and wallet files off the machine and sends them to the attacker.

What did ASD actually do?

ASD took control of the server the criminal was using to issue commands, then disconnected it from the 180,000 infected PCs that were checking in. Think of it as changing the locks on a dispatch office: the vans are still out there, but the boss can no longer radio them.

The agency hasn't named the operator or said how it got in. It also hasn't claimed the malware was removed from victim machines. That distinction matters. A computer infected with Amadey after this operation is still infected. It simply isn't talking to this particular controller anymore. A fresh operator could, in principle, try to re-establish contact if the malware's fallback channels are still reachable.

Why does this matter for ordinary people?

Most Amadey victims are home users who installed something they shouldn't have, often a cracked game or a fake browser update. The damage lands later, somewhere else entirely.

Microsoft's researchers describe the pattern bluntly. An infostealer on a personal laptop can hand over the owner's work VPN password and their single sign-on session (the login that unlocks all their work apps at once), plus the browser cookies that let an attacker skip past multi-factor authentication (the extra prompt meant to stop stolen passwords being reused). Those credentials get sold to access brokers, middlemen who package them up and resell them to ransomware crews. By the time a company notices, the original infection on an employee's home PC is weeks old. We covered exactly this credential-theft chain on 3 September, where the session cookie turned out to be the more dangerous trophy.

If your machine may have been caught in this: change passwords on anything important from a clean device, sign out of all active sessions in your main accounts, and run a reputable malware scanner.

How does this fit Australia's wider cyber posture?

The takedown reads as a deliberate signal. Australia's cyber agency used its 2025-26 annual threat report to argue that the line between state-backed espionage and ordinary cybercrime is fading, and that disrupting criminal infrastructure directly is now part of the job. That argument landed alongside a 5 October order requiring all 194 Australian federal entities to audit ageing technology after an AI-assisted attack exposed government networks.

After a decade of botnet takedowns, my read is this: these operations buy time, not victory. The Amadey brand will likely reappear under new infrastructure within weeks, because the economics haven't changed. What has changed is that an allied signals agency is willing to say, on the record, that it reached into a criminal's server and turned it off. That's the part worth watching.