20,000 malicious IPs and domains taken down in INTERPOL infostealer crackdown

Operation Secure (January–April 2025) was an INTERPOL-coordinated effort across 26 countries and private partners to disrupt infostealer infrastructure: over 20,000 malicious IPs/domains were taken down (79% of identified suspicious IPs), 41 servers seized, 32 suspects arrested, and roughly 216,000 victims/potential victims notified. The report explains infostealers' role in stealing credentials and enabling further attacks (ransomware, BEC) and highlights regional enforcement actions and intelligence sharing.