Rhadamanthys Stealer Servers Reportedly Seized; Admin Urges Immediate Reinstallation

Widespread reports indicate that Rhadamanthys stealer infrastructure has been disrupted as German and EU law enforcement actions appear to have seized the main control, triggering urgent security alerts and a call for immediate reinstallation. The incident is said to have unfolded over the past 24–48 hours, with administrators warning users to pause operations and migrate their infrastructure to new servers.

Threat intelligence chatter notes that the primary Rhadamanthys login method was forcibly changed to certificate-based authentication, effectively locking out legitimate operators with standard password credentials. One administrator described guests accessing the server, the root password being deleted, and all control panels switching to strict certificate login.

The disruption has also rendered the Rhadamanthys Tor onion domain and the associated eXploit forum domain inaccessible or blocked, leaving users to rely on mirror links and alternate Tor routes. The toolkit has been linked to thousands of credential thefts, data exfiltration campaigns and fraud operations globally, underscoring the scale of the impact as operators race to rebuild.