PRIVACY DETECTIVE · INTERPOL AND POLICE IN 26 COUNTRIES
INTERPOL infostealer crackdown "Operation Secure" (2025)
An international crackdown on infostealer malware, whose harvested browser credentials, passwords, cookies, card details and crypto-wallet data are traded underground and used as a gateway to further attacks. Over 20,000 IPs/domains taken down; 216,000+ potential victims notified.
Checked 2026-10-03
- Affected
- 216,000 + victims and potential victims notified
- Data taken
- Login ID · Password · Session cookie · Payment card · Crypto-wallet data
- Confirmed money loss
- None confirmed
- Entry vector
- Infostealer
- Attack → detection
- Not published
- Fines
- None / not published
- Proceeds recovered
- Not published
05 STEPS
Breach → taken → resold → money → who paid
- 1. HOW IT HAPPENED
How it happened — Browser-stored data stolen from infected devices
- 2. WHO GOT THE DATA
Who got the data — Infostealer operators and their criminal customers
- 3. HOW IT WAS RESOLD
Was it resold — Stolen logs traded on the criminal underground (INTERPOL)
- 4. HOW IT BECAME MONEY
How it became money — Not established by official sources
- 5. WHO PAID THE LOSS
Who paid the loss — Per-victim money losses not published
TIMELINE
Time to detect, report and notify
- Attack start → detection
- — → — · Not published
- Detection → report
- Not published
- Detection → customer notice
- Not published
Operation ran January–April 2025
DATA
What was taken, and what it enables
- Authentication data
- Login ID · Password · Session cookie
- Financial data
- Payment card · Crypto-wallet data
What this combination can be used for
- Card or account data → Payment fraud, unauthorised transfers
INTERPOL: stolen logs become the gateway to ransomware, data breaches and business email compromise. International agency 2025-06
CRIME-AS-A-SERVICE
Roles confirmed in this case
○ Victim data stolen → ○ Brokered and resold → ○ Buyer takes over accounts → ○ Fraud or unauthorised payment → ○ Mule account → ○ Laundering → ○ Cash-out
● step confirmed in this case · ○ not established (which does not mean it did not happen)
GEOGRAPHY
Location facts, kept apart
| Field | Value | Basis |
|---|
| Arrest country | Viet Nam 18, Sri Lanka 12, others — 32 in total | Confirmed by law enforcement International agency 2025-06 |
| Infrastructure location | 41 servers seized across 26 Asia-Pacific countries | Confirmed by law enforcement International agency 2025-06 |
| Suspect nationality | Not published Arrest country is not nationality. | Unknown |
Login-IP countries can differ from an attacker’s nationality or base because of VPNs, proxies and hijacked devices. Nationality appears only for individuals named by investigators and is never generalised to a country.
LOSS & PROCEEDS
Victim loss and criminal proceeds
- Victim money loss
- No amount established
RESPONSE & ENFORCEMENT
Company response and enforcement
- Takedown · INTERPOL and 26 countries · 2025-06-11 · Final
- 20,000+ IPs/domains down, 41 servers and 100+ GB seized, 32 arrests, 216,000+ notified. Private partners: Group-IB, Kaspersky, Trend Micro International agency 2025-06
- Security spend before vs costs after
- Not public — security budgets and legal costs are not estimated
DETECTIVE RADAR
INTERPOL infostealer crackdown "Operation Secure" (2025) from other angles
✓ analysed · △ applies, not analysed yet · not applicable: Origin Detective, Cost Detective, Distribution Detective, Inflation Detective, Discount Detective, Value Detective, Hype Detective, Hogu Index, Tax Detective, Wage Detective, Ingredient Detective (food & drinks) · All axes on one page