Microsoft uses AI to link two malware operations in racketeering suit

Microsoft, with international law enforcement and multiple security vendors, used AI-assisted analysis and RICO-based legal claims to link and disrupt two coordinated malware operations—StealC (an infostealer) and Amadey (a malware-as-a-service loader). The action resulted in suspension or blocking of more than 200 domains/C2 servers, highlighted shared infrastructure enabling joint operation, and followed evidence of wide infection (over 140,000 compromised hosts in a two-week window) and large-scale theft, while also pursuing civil claims against alleged operators.