Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
Summary: Australia's Signals Directorate gained access to the backend of an Amadey malware operation and disconnected its controller from 180,000 infected computers worldwide, including some in Australia, according to acting deputy director-general Tauri Gregory. Amadey, sold as a service since 2018, installs additional malware such as the StealC infostealer, steals credentials, and gives buyers remote access; ESET has tracked 53 separate Amadey botnets that do not share infrastructure.
Key Takeaway: Cutting off one controller does not undo theft already committed: stolen credentials and session cookies can sit unused for months, and a stolen cookie can bypass MFA. ASD also reported breaking into a separate sale of 5 terabytes of stolen business data, including an estimated 4.8 million files taken from Australians, that the victim did not know had been breached.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026