Operation Endgame leads to the seizure of AvCheck, an antivirus evasion tool

This service allowed cybercriminals to test whether their malware was detected by various antivirus programs.

U.S. and Dutch authorities announced on May 29 and 30, 2025, that they had seized AvCheck as part of the international Operation Endgame. The service presented itself as a “high-speed antivirus scanner,” enabling users to determine whether a piece of malware was flagged by antivirus engines.

Such services are not illegal per se and are commonly used by cybersecurity researchers. However, several features indicated that AvCheck was aimed at cybercriminals: it guaranteed user anonymity and did not share any information with antivirus vendors about malware that bypassed their protections.

“A cybercriminal wants to know whether their malware is detected by virus scanners. A service like AvCheck therefore plays a crucial facilitating role in the cybercriminal ecosystem,” stated Dutch police. In addition to the U.S. and the Netherlands, the seizure was supported by France, Germany, Denmark, Ukraine, and Portugal.

Endgame is an international law enforcement operation targeting the tools that facilitate the use and spread of malware. It has already led to the dismantling of various malicious software, including infostealers like Lumma, droppers like Bumblebee and Smokeloader, and botnets such as Pikabot and Qakbot.