Law Enforcement and Microsoft Tear Down Command Infrastructure Behind Amadey and StealC
Hundreds of C2 servers went dark in a coordinated takedown targeting the shared hosting backbone used by two prolific infostealer families.
Key points
- Microsoft and law enforcement partners disrupted hundreds of C2 servers used by Amadey and StealC.
- Both malware families targeted authentication material including session cookies and locally cached OIDC tokens.
- The operation hit shared infrastructure, meaning one action disrupted multiple simultaneous campaigns.
- Short-lived tokens with strict audience claims and back-channel logout support limit the damage a successful steal can cause.
- Detailed IOC advisories have not been released as of publication.
What actually happened?
Microsoft and a coalition of law enforcement agencies and cybersecurity firms disrupted hundreds of command-and-control servers used by both Amadey and StealC. C2 servers are the endpoints malware phones home to for tasking and data exfiltration. The operation targeted infrastructure rather than the malware authors themselves.
Amadev has been in circulation since at least 2018, functioning as a loader and credential harvester. StealC emerged more recently and became a go-to tool for session cookie theft and credential scraping. That both families relied on overlapping infrastructure is not a coincidence: the underground economy runs on infrastructure-as-a-service, bulletproof hosting and resold access that lets threat actors spin up campaigns without managing their own servers. Our June reporting on the search-as-a-service credential economy and on infostealers as ransomware's front door laid out exactly how that supply chain works.
Should you worry about your sessions?
Disrupting shared infrastructure matters more than disrupting a single actor's C2. One takedown kills one campaign; hitting the shared backbone can interrupt dozens at once.
From an identity perspective, both families harvest authentication material specifically. Saved browser credentials, session cookies, OIDC tokens cached locally. Neither needs your password if a valid post-authentication session token is available. MFA offers no protection once the session exists. What limits the blast radius is session lifetime, token binding and revocation: short-lived tokens with strict audience (aud) claims and back-channel logout support, as specified in the OpenID Connect back-channel logout spec, would meaningfully constrain what a thief can do with stolen material.
How long will the disruption last?
Infrastructure takedowns impose real cost and delay. They are not permanent. Threat actors rebuild, and new bulletproof hosts appear. But when disruption targets shared infrastructure the effect is disproportionate to the effort involved, and that calculus is worth repeating every time a takedown of this shape lands.
Vendors have not released detailed technical advisories enumerating specific IOCs or affected IP ranges as of publication. Those are worth watching for.
