Operation Endgame Puts 179,745 CastleRAT Email Addresses and Passwords in Have I Been Pwned

About 179,700 email addresses and the passwords stolen with them by the CastleRAT malware are now searchable in Have I Been Pwned. The data comes from the latest Operation Endgame action, in which Europol and police in nine countries took down the servers behind three malware families: Gootloader, CastleRAT and StealC.

Europol announced the operation on 12 November 2026. Have I Been Pwned added the CastleRAT dataset on 13 November, listing 179,745 affected accounts with two data classes: email addresses and passwords. These are not addresses leaked from one company database. They were taken from infected computers, which means the passwords are real credentials that victims typed or stored on those machines.

What Europol took down

Europol describes the three families as "cybercrime-as-a-service" tools used to open the door to ransomware and data theft. For Gootloader, 14 servers and 218 domains were taken down and 681 infected websites were cleaned; the loader spread through fake legal documents hosted on compromised websites, often hacked WordPress sites. For CastleRAT, a remote access trojan known since 2025, 120 servers and 39 domains were seized. For StealC, a stealer built to pull passwords, stored access data and digital identities from infected machines, 102 servers were dismantled, continuing an action that started in June 2026.

According to Europol, the suspects used the stolen credentials to sell them and to launch further attacks such as ransomware. The agency says victim data will be shared with notification platforms including Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and the Dutch NCSC, so that people whose credentials were stolen by CastleRAT can be alerted.

Participating agencies came from Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom and the United States, including the German BKA, the UK National Crime Agency and the FBI.

What is in the Have I Been Pwned dataset

Have I Been Pwned's CastleRAT entry lists about 179,700 email addresses and passwords, provided by Europol and its partners. The service says the roughly 893,000 unique passwords were seen more than 3 million times across accounts used on infected computers, and that they are now searchable in Pwned Passwords. Its advice is direct: change any affected password on every account where it was used, and turn on two-factor authentication wherever it is offered.

For email teams, the important detail is the source. Malware on a workstation captures whatever the user logs into: webmail, the admin console of an email platform, a DNS registrar, a CRM. An email address in this dataset can point to stolen access to systems that send mail in your name, not only to a personal inbox.

Why it matters for email programmes

Stolen logins are one of the main ways sending accounts get abused. With a valid password for an email service provider, an attacker can import a list and send phishing or spam from your verified domain, with your SPF and DKIM passing. With mailbox credentials, the same access feeds business email compromise: real threads, real signatures and replies that recipients trust. The damage lands on your domain reputation and on your relationship with your provider, which may suspend an account caught sending abuse.

The Apify incident earlier this week showed how exposed account data, including two-factor codes, turns into a security task for every connected tool. Operation Endgame is a reminder from the other side: some of your users may already have had their machines infected, and their credentials may have been circulating before anyone noticed.

Action checklist

• Search your domains in Have I Been Pwned with its domain search feature, which shows every address on a domain you have verified that appears in a breach, including CastleRAT.
• Reset passwords for any listed address on your email platform, webmail, DNS registrar and CRM, and never reuse the old password elsewhere.
• Turn on two-factor authentication for every user of your sending platform and mailboxes, and remove accounts that no longer need access.
• Rotate API keys and SMTP credentials that may have been stored on an affected workstation, then check sending logs for imports, campaigns or senders you did not create.
• Check the machine itself: a listed address means a computer was infected, so have it cleaned or rebuilt before new passwords are typed on it.
• Keep DMARC at enforcement and watch your reports, so spoofing that follows a credential leak is rejected. See DMARC reject vs quarantine.

Sources

1. Europol: 6.4 million victim datasets secured in international operation against malware networks, 12 November 2026
2. Have I Been Pwned: CastleRAT, added 13 November 2026

Related on SMTPedia

• Apify breach exposes customer emails, billing data and 2FA codes
• How to detect phishing emails that pass every check
• DMARC reject vs quarantine: when to move and how