Europol just dismantled three major malware networks that stole logins from WordPress sites and employee computers. Here's how to check if your business was hit and what to do today.
This week, Europol and its international partners announced the latest phase of Operation Endgame, taking down the infrastructure behind three malware families that have been quietly stealing logins from businesses for years: Gootloader, StealC and CastleRAT. The numbers are striking — 235 servers and 257 domains seized, and more than 6.4 million victim credentials recovered from the criminals' own systems.
If you run a small or medium business in Switzerland, this isn't just a headline about a distant police operation. It directly touches the tools you use every day.
Why this matters for your business
Gootloader works by infecting legitimate websites — including a large number running WordPress — and using them to quietly drop further malware onto visitors' computers. According to the U.S. Justice Department, Gootloader has infected at least 25,000 computers worldwide since 2018. In this takedown alone, police removed the malware from 681 hacked websites and seized 14 servers and 218 domains tied to the operation, according to Europol's official Operation Endgame site.
StealC and CastleRAT work differently but with the same goal: they sit quietly on infected machines and harvest whatever login details employees type — email, banking portals, cloud admin panels, remote access tools. Europol confirmed these stolen credentials were being sold on to other criminals, often to be used later for ransomware attacks.
Many Swiss SMEs run a WordPress website for marketing or e-commerce, and many employees reuse passwords across work and personal accounts. That combination is exactly what these three malware families were built to exploit.
What to do today
Authorities were explicit in their guidance, reported by CyberScoop: WordPress site owners should update credentials, enable multi-factor authentication, and patch any outstanding vulnerabilities. Don't wait for a breach notification to land in your inbox — act now:
- Check if your email or domain shows up in the leaked data. The seized victim data is being distributed to breach-notification services including HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC. Check your business domain and key staff email addresses once the data is live.
- Rotate passwords now, especially for admin accounts. Don't wait for a notification — if your business runs WordPress, change the admin password and any accounts with publishing or plugin access.
- Turn on multi-factor authentication everywhere it's available — WordPress admin, email, remote access tools, and cloud services like Microsoft 365. This alone stops most credential-based attacks even if a password has already leaked.
- Patch your WordPress core, themes and plugins. Gootloader relies on outdated or vulnerable sites to plant its payload. An up-to-date site is a much harder target.
- Review staff machines for infection signs — unusual slowdowns, unexpected pop-ups, or unfamiliar remote-access software. If StealC or CastleRAT got onto a device, a password reset alone may not be enough; the device itself may need cleaning.
- Remind staff not to reuse passwords between personal and business accounts. A credential stolen from one site is often tried everywhere else.
The bigger picture
Operation Endgame is one of the largest coordinated law-enforcement actions against credential-theft infrastructure in recent memory, and it's a reminder that stolen logins don't stay stolen quietly — they get resold, often ending up fuelling ransomware attacks months later. Credential theft, malware-laced websites and AI-assisted hacking are now part of the daily threat landscape for every business, not just large enterprises.
We'll keep monitoring this space and reporting on what Swiss business owners need to act on. If you'd rather have someone else keep watch on patching, multi-factor authentication and basic security hygiene for your business, TMC (The Mejlerö Company GmbH) supports SMEs across Obwalden, Nidwalden, Luzern and Zürich with exactly this kind of day-to-day IT and security support — including Microsoft 365 administration, endpoint protection and two-factor authentication setup. A free network analysis and a free one-hour consultation are available if you want a second opinion on where your business stands today.
Switzerland.