The Australian Signals Directorate (ASD) says its operators broke into the backend of a criminal Amadey malware operation and cut the attacker off from roughly 180,000 infected computers around the world, including machines in Australia. The agency disclosed the offensive cyber operation on October 27, 2026, the same day it released its seventh Annual Cyber Threat Report.
“The next steps that we took were to disconnect that Amadey controller from all those victims,” ASD acting deputy director-general of intelligence Tauri Gregory told ABC News. “And so, effectively, that cyber criminal can no longer access those 180,000 computers and no longer steal data from all those people.”
Inside the Amadey backend
According to ASD, its operators gained access to the operation’s back end and found the criminal network controlled about 180,000 computers globally. The agency then severed the link between that controller and the infected machines.
Gregory said the impact would have been significant had the agency not stepped in. Without the operation, he said, 180,000 businesses or individuals would have kept having their data stolen and either sold on the dark web, monetized in other ways or used to fuel follow-on crimes such as fraud and identity theft.
ASD said it found Amadey hidden in a free, illegitimate copy of Photoshop in one case, and it found evidence of the malware being sold on the dark web for about $500 USD. The agency did not say when the operation took place, which countries the affected machines were in beyond Australia, or whether anyone has been identified or charged.
Offensive operations like this fall under ASD’s offensive cyber mission, which allows the agency to disrupt cybercriminals offshore by disabling their infrastructure. These operations require explicit authorization from the Australian government.
One affiliate among dozens
The takedown hit a single criminal’s operation, not Amadey as a whole. That distinction matters because of how the malware is sold.
Amadey is a modular malware loader that has been advertised to criminals on underground forums since October 2018, according to ESET research. Its main job is to install additional malware, such as the StealC infostealer, though it also offers modules for data theft and remote access.
Buyers license the malware and receive a self-hosted administration panel that they run on their own servers. That gives each affiliate direct control over victim data and the payloads pushed to infected machines. ESET tracked 53 distinct Amadey clusters that did not share infrastructure, with one cluster accounting for nearly 34% of processed samples and delivering an average of around 14 payloads to each victim.
ASD did not say which cluster it disrupted, so it is unclear whether the 180,000 machines belonged to the largest known Amadey botnet or a separate affiliate. Other affiliates running their own panels would not be affected by this action.
ESET found the most common infection routes were fake software updates, cracked software installers and third-party malware loaders.
Second hit on Amadey this year
The ASD operation follows an international crackdown on the same malware family. Between June 15 and 19, 2026, Operation Endgame targeted infrastructure tied to Amadey, StealC and SocGholish. Europol said 326 servers and 142 domains were actioned, about 27 million stolen login credentials were recovered and more than EUR 41 million in criminal crypto assets were restricted. The same action week also disrupted the SocGholish network linked to Evil Corp.
Europol’s announcement did not list Australia among participating law enforcement agencies, though the Royal Canadian Mounted Police named Australia as a participating country. ASD has not said whether its Amadey operation was connected to Operation Endgame. The Australian Federal Police has not been publicly named as part of this specific operation.
Destroying 5 TB of stolen data
ASD also described a separate operation in which it was tipped off to the sale of 5 terabytes of data stolen from a business that did not know it had been hacked. The data reportedly included sensitive business documents, personal data, logins and passwords.
Gregory said ASD broke in and destroyed the data before it could be sold, including an estimated 4.8 million files stolen from Australians and hundreds of thousands of files belonging to victims in other countries. ASD did not name the business.
Cutting the controller does not undo the theft
Disconnecting a controller stops new commands and new theft from those machines, but it does not remove the malware or claw back credentials that were already taken. Data harvested by infostealers can sit unused for months before it is sold or abused, and stolen session cookies can let attackers bypass multi-factor authentication. For background on how this data is collected and traded, see our guide on infostealer malware.
Anyone who has installed cracked software or a pirated copy of a paid app should assume the machine may be compromised. Practical steps include:
- Running a full scan with up-to-date security software, or reimaging the device if an infection is confirmed
- Changing passwords from a clean device, starting with email, banking and work accounts
- Signing out of all active sessions to invalidate stolen cookies
- Enabling passkeys or app-based multi-factor authentication where available
ASD’s Annual Cyber Threat Report 2025-26 says the agency’s Australian Cyber Security Centre received more than 82,000 cybercrime reports in the 2025-26 financial year and responded to more than 1,500 incidents. The report itself does not describe the Amadey operation.
