Operation Endgame seizes 326 servers, recovers 27 million credentials from Lumma and SocGholish

Law enforcement agencies from Canada, Denmark, Germany, the Netherlands, the UK and the US executed coordinated takedowns on 19 June 2026. Microsoft invoked RICO statutes against overlapping Lumma and SocGholish infrastructure, enabling treatment as a single conspiracy. The action severed control of more than 18,000 infected hosts and 200 command-and-control servers.

Public Europol and Microsoft disclosures list 326 servers and 142 domains actioned, with ESET, Proofpoint, IBM X-Force and Bitsight supplying telemetry. SocGholish distribution via compromised WordPress sites was curtailed by credential resets and malware removal. Lumma’s mass credential-harvesting pipeline lost its primary delivery channels.

The operation directly targeted the malware-as-a-service assembly line rather than individual actors. Overlapping C2 infrastructure and shared bulletproof hosting made RICO linkage feasible, raising the cost of reconstitution. Similar multi-tool actions against Emotet and TrickBot produced 6- to 18-month recovery lags before new variants emerged.

Administrators of affected sites received cleanup directives; exposed credential holders are under notification. Follow-on monitoring will track re-emergence of Lumma loaders on alternative infrastructure within 90 days.