ESET takes part in Operation Endgame to disrupt Amadey and Stealc
2026-06-25T08:51:41Z•0aa7828ea22994202695db3775bcd94cfdb7158e3e4aed5ce8d48d7749fcc754
AI-assisted malwareAPTAmadeyAndroid RATBTMOBEDR killersEvilTokensFishMongerFrostyNeighborGentlemen RaaSGopherWhisperNFC payment trojanNGateOAuth/SSO token theftOT securityOceanLotusOperation EndgameSMB cyber readiness','ransomware readiness','cloud workload gapsScarCruftSprySOCKSStealcWebwormkernel driver abusephishingsupply chain attack
What happened
ESET’s WeLiveSecurity updates for Mar–Jun 2026 highlight coordinated takedowns and multiple high-risk threats: ESET assisted in Operation Endgame to disrupt the Amadey botnet and Stealc infostealer; researchers documented kernel-level stealth backdoors (SprySOCKS) used by FishMonger and exposed EDR-killer frameworks sold by the Gentlemen RaaS ecosystem. The feed also details token-based phishing (EvilTokens) that bypasses password theft, Android RATs (BTMOB), supply‑chain compromises (ScarCruft), new and evolving APT activity (OceanLotus, Webworm, GopherWhisper, FrostyNeighbor), and a possibly
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- eset_welivesecurity
- Record identifier
- 0aa7828ea22994202695db3775bcd94cfdb7158e3e4aed5ce8d48d7749fcc754
- Enrichment time
- 2026-06-25T08:51:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.