Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

INTERPOL says Operation Secure took down more than 20,000 malicious IP addresses or domains linked to infostealer malware, seized 41 servers and led to 32 arrests. Authorities also notified more than 216,000 victims and potential victims—a figure that does not mean every person notified had a confirmed infection.

What happened in Operation Secure?

In a release published on 11 June 2025, INTERPOL said law-enforcement agencies in 26 countries across the Asia and South Pacific region carried out Operation Secure from January through April 2025. They located servers, mapped physical networks and conducted targeted takedowns of infrastructure associated with information-stealing malware.

INTERPOL reported that coordinated efforts took down 79 per cent of the identified suspicious IP addresses. That is the agency’s reported proportion, not an independently evaluated measure of the operation’s effectiveness. The agency also reported seizing 41 servers and more than 100 GB of data.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Operation dates and planning dates are different

The operation ran from January through April 2025. INTERPOL’s Asia and South Pacific Joint Operations against Cybercrime (ASPJOC) project page describes a broader planning and coordination period, from November 2024 through April 2025. These are different timeframes, not competing dates for the operation itself. INTERPOL’s detailed Operation Secure announcement gives the operation dates; the ASPJOC project page gives the broader planning period.

Why arrest totals differ

INTERPOL’s detailed release reports 32 suspects arrested in connection with illegal cyber activities. The ASPJOC page reports 30 individuals arrested. The pages do not explain whether the difference reflects an update, a different cutoff or a counting method, so the totals should be attributed to their respective sources rather than combined. Arrests are not convictions.

What is an infostealer, and what can it take?

An infostealer is malware designed to extract sensitive information from an infected device. INTERPOL lists browser credentials, passwords, cookies, payment-card details and cryptocurrency-wallet data among the information these tools can collect.

Stolen information may be gathered into logs and traded in criminal marketplaces. Criminals can then use it as a foothold for further activity, including ransomware deployment, data breaches, fraud and business email compromise. INTERPOL’s Operation Secure announcement describes these potential uses; its 2025 Spotlight retrospective also notes that stolen passwords, cookies and card details may be traded and used in further attacks.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Does a notification mean your device was infected?

No. INTERPOL reported that authorities notified more than 216,000 victims and potential victims, but did not say that every notified person had a confirmed infection. The total includes people whose information may have been exposed; it is not a confirmed-infection count.

INTERPOL said notification was intended to help people act quickly, with examples including changing passwords, freezing accounts or removing unauthorized access. The announcement does not identify the accounts or devices of individual recipients or provide a full incident-response checklist. If you receive a notice, use the details and instructions in that notice to determine which accounts or services it concerns.

What INTERPOL says the operation achieved

Reported outcome INTERPOL’s figure How to read it
Malicious infrastructure taken down More than 20,000 IP addresses or domains Infrastructure linked to infostealer malware; the figure refers to IP addresses or domains taken down.
Identified suspicious IP addresses taken down 79 per cent INTERPOL’s reported proportion from coordinated efforts, not an independent evaluation.
Servers seized 41 Servers seized during the operation, according to INTERPOL.
Data seized More than 100 GB Data seized during the operation, according to INTERPOL.
People arrested 32 in the 11 June 2025 detailed release; 30 on the ASPJOC page The sources give different totals and do not explain the discrepancy. These are arrest figures, not convictions.
People notified More than 216,000 victims and potential victims Includes potential victims; it is not a count of confirmed infections.
Participating countries 26 Countries involved in the operation, as reported by INTERPOL.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What is established—and what is not

INTERPOL characterized Operation Secure as a collaborative effort to disrupt malicious infrastructure and help prevent harm to individuals and businesses. Its Director of Cybercrime, Neal Jetton, said: “INTERPOL continues to support practical, collaborative action against global cyber threats. Operation Secure has once again shown the power of intelligence sharing in disrupting malicious infrastructure and preventing large-scale harm to both individuals and businesses.” This is INTERPOL’s assessment of the operation; the cited releases do not provide an independent evaluation of its impact.

INTERPOL also named Group-IB, Kaspersky and Trend Micro as private-sector partners that contributed Cyber Activity Reports and intelligence sharing ahead of the operation. That describes their role in the effort, not an endorsement of their consumer products.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

For additional regional context, INTERPOL’s Asia and South Pacific threat assessment frames Operation Secure as part of coordinated regional action against cybercrime.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.