Global crackdown dismantles cybercrime supply chain worth $47M

A coordinated international operation has disrupted a sophisticated cybercrime ecosystem that generated tens of millions in illegal profits by targeting two of the most prevalent malware-as-a-service platforms in active campaigns. The takedown, led by law enforcement agencies alongside major tech firms, represents a rare simultaneous strike against Amadey and StealC—two tools that have become staples in modern online fraud.

A dual-threat malware ecosystem uncovered

Amadey, a malware-as-a-service platform first detected in 2018, has evolved into a versatile toolkit for cybercriminals. It specializes in infiltrating devices to deliver customized malicious payloads, including ransomware and other forms of extortion. Recent investigations revealed Amadey was abusing legitimate platforms like GitHub to host its infrastructure and exfiltrate sensitive system data from compromised machines. Its modular design allows threat actors to tailor attacks for maximum impact, making it a preferred choice among fraudsters seeking scalable, low-cost solutions.

StealC, on the other hand, operates as an infostealer-as-a-service, designed to harvest credentials, authentication cookies, cryptocurrency wallets, browser extensions, and files matching specific patterns. Cybercriminals use StealC to automate the extraction of valuable data from infected systems, which is then sold or leveraged in secondary attacks. The platform’s efficiency and ease of use have made it a critical component in many fraudulent operations, contributing to an estimated $47 million in combined losses from ransom payments and other illicit activities.

Shared infrastructure exposes a critical vulnerability

While Amadey and StealC function independently, Microsoft’s analysis revealed an unexpected overlap: both platforms relied on overlapping backend infrastructure to operate. This discovery was made possible through advanced AI-driven threat intelligence, which uncovered previously undetected connections between the two malware families. The shared reliance on common servers and communication channels created a critical weak point in the cybercriminal supply chain.

Leveraging this insight, Microsoft’s legal team pursued a court order to disrupt both platforms simultaneously. The operation, executed in collaboration with international law enforcement, effectively severed the technical and operational links that sustained these tools. Authorities confirmed the takedown disrupted active command-and-control servers and disrupted the distribution networks that propagated the malware to victim devices.

Broader implications for cybersecurity and fraud prevention

The success of this operation underscores the growing effectiveness of cross-border collaborations between public and private sectors in combating cybercrime. By targeting the infrastructure that fuels malware-as-a-service ecosystems, authorities are addressing the root causes of widespread fraud rather than merely reacting to individual incidents. The case also highlights the importance of AI-driven threat detection in identifying hidden connections between seemingly unrelated malicious tools.

For organizations and individuals, the takedown serves as a reminder of the persistent threat posed by commoditized cybercrime tools. While the disruption of Amadey and StealC is a significant victory, experts warn that new variants or entirely different platforms will likely emerge to fill the void. Proactive monitoring, robust cybersecurity practices, and ongoing collaboration between industry and law enforcement remain essential to staying ahead of evolving threats.