Police took down three malware networks, then handed the stolen passwords to Have I Been Pwned

Europol said on Thursday that police in nine countries, among them the UK, Germany, Poland, Canada and the US, had seized 235 servers and 257 internet domains used by three pieces of malware: Gootloader, CastleRAT and StealC. It's the latest round of Operation Endgame, the long-running international effort against the tools criminals use to get into ordinary computers. On the seized machines, investigators found 6.4 million sets of stolen victim data.

The three did different jobs. Gootloader lurks on hacked websites disguised as free legal document templates, and the US Justice Department says it has infected more than 25,000 computers. StealC is a password stealer. CastleRAT is a remote access trojan, which means whoever runs it can control the infected PC from a distance, and it has been used to plant ransomware.

The part that may involve you came on 13 November, when Have I Been Pwned added a CastleRAT entry: roughly 179,700 email addresses and 893,000 unique passwords captured from infected computers. Type your address into haveibeenpwned.com and look. A match here isn't like turning up in an ordinary company breach. It suggests a computer you used was itself infected, so do the clean-up from another device you trust. Change your email password first, then every account that shared a password, and turn on two-step sign-in. Only then deal with the suspect PC, with a full Microsoft Defender scan or a proper look from someone who knows what they're doing. Passwords saved in the browser are exactly what this kind of malware collects, as we've explained before.

Tendvane can't remove malware, but its Safety check lists programs that crept onto the PC without you knowingly installing them, a useful second look on a machine you no longer quite trust.