StealC is a Windows commodity information stealer sold as malware-as-a-service, first marketed in early 2023 and built by borrowing from Vidar, Raccoon, Mars and RedLine. It steals browser credentials, cookies, crypto wallets and files. In March 2025 StealC V2 reworked its command-and-control to an RC4-encrypted JSON protocol and added targeted-delivery controls. It is commonly dropped by the Amadey loader, and its infrastructure was disrupted in a 2026 Operation Endgame action. MITRE ATT&CK tracks it as S1055.

StealC: The Commodity Infostealer That Keeps Reinventing Itself

StealC is a Windows commodity information stealer and malware-as-a-service platform first marketed in early 2023, explicitly assembled by borrowing from earlier stealers including Vidar, Raccoon, Mars and RedLine. It harvests credentials, cookies, autofill data, crypto-wallet material and files from a large catalog of browsers, extensions, wallets and apps, with a customisable file grabber. In March 2025 the author shipped StealC V2, a substantial rework that moved command-and-control to an RC4-encrypted JSON protocol and added payload-targeting controls. StealC is very commonly dropped by the Amadey loader, and its infrastructure was a named target of an Operation Endgame disruption in 2026. MITRE ATT&CK tracks it as S1055.

Overview & MaaS Model

StealC was first listed on Russian-speaking forums in January 2023 by an actor using the handle “Plymouth,” per SEKOIA, which published its analysis in February 2023. It is commodity crimeware used by many independent affiliates rather than any single group, and it iterates rapidly — multiple vendors note near-continuous updates. Subscription pricing is reported at roughly $200 per month in secondary reporting; treat that figure as commonly cited rather than vendor-confirmed.

Technical Capabilities

Browser theft: saved logins, cookies and autofill. SEKOIA’s original analysis counted support for roughly 22 browsers, with later sinkhole work describing configurations pulling from dozens of browsers and more than 100 crypto-wallet, password-manager and authenticator extensions. T1555.003 T1539
Crypto theft: browser extension wallets and desktop wallets. T1005
File grabber: operator-defined file masks and paths. T1552.001
App-Bound Encryption bypass: reporting indicates StealC injects into a suspended or legitimate process to defeat Chromium App-Bound Encryption for cookie and credential theft. T1055.012
Host profiling: geolocation, hardware ID and installed software to drive server-side targeting. T1518 T1614

StealC V2 (March 2025)

New C2 protocol: a streamlined JSON transport protected with RC4, replacing earlier largely plaintext communications. T1573
Server-side decryption: V2 exfiltrates login data, cookies and the browser master key and performs decryption server-side, per S2W.
Targeted delivery: a rebuilt operator panel conditions payload delivery on geolocation, hardware ID and installed software.
Obfuscation: Themida packing, a multi-stage deobfuscation routine and randomised JSON request parameters to defeat static signatures. T1027
Dropped checks: Zscaler reported earlier anti-VM checks and third-party DLL downloads were removed in the rewrite — possibly collateral, and possibly temporary.

Distribution

StealC is very commonly delivered by the Amadey loader, which often establishes scheduled-task persistence and then pulls StealC; Trellix documented an Amadey campaign retrieving StealC from a compromised GitLab instance. It is also distributed through cracked-software lures, malvertising and the broader loader ecosystem. Paste-and-run lures of the ClickFix family dominate infostealer delivery generally in this period, though a StealC-specific ClickFix campaign is not asserted here.

MITRE ATT&CK Mapping

Tactic	Technique	Usage
Credential Access	T1555.003 Credentials from Web Browsers	Saved logins
Credential Access	T1539 Steal Web Session Cookie	Session hijack
Collection	T1005 Data from Local System	Wallets, file grabber
Defense Evasion	T1055.012 Process Hollowing	App-Bound Encryption bypass
Command and Control	T1573 Encrypted Channel	RC4 over JSON (V2)
Defense Evasion	T1027 Obfuscated Files or Information	Themida packing
Exfiltration	T1041 Exfiltration Over C2 Channel	Stolen data to C2

Operation Endgame (2026)

On the figures

A Europol-coordinated action with private partners disrupted Amadey and StealC infrastructure in mid-2026. Reported figures vary by outlet — Microsoft’s Digital Crimes Unit described action against more than 200 command-and-control domains and IP addresses, while operation-wide tranche figures (recovered credentials, frozen cryptocurrency) are not StealC-specific. Attribute hard numbers to Europol’s and Microsoft’s own releases.

Detection Signals

Amadey precursor activity: scheduled-task persistence, loader beaconing, then a second-stage download.
Suspended-process creation followed by remote memory write and thread resume in a child of a browser or benign binary.
A non-browser process reading login data, cookies and web-data SQLite files and extension stores.
V2 C2: HTTPS POST of JSON with randomised parameter names and RC4-encrypted bodies. Pull hard C2 values from the Zscaler, S2W and Bitsight reports.

Detection & Mitigation

Deploy EDR rules for cross-process injection into suspended processes and for non-browser reads of browser credential stores.
Monitor for Amadey indicators and scheduled-task creation by freshly written binaries.
Harden the delivery front end: block paste-and-run PowerShell, cracked-software lures and malicious ad chains.
Treat any stealer infection as full credential, cookie and session compromise — force session invalidation and credential rotation, not just malware removal.
Egress filtering and TLS inspection to catch anomalous JSON and RC4 C2.

Contain Infostealer Compromise

Mjolnir Security helps organisations detect infostealer activity and respond to the credential and session theft it causes.

Credential Exposure MonitoringThreat HuntingManaged Detection & ResponseIncident ResponseDark Web Intelligence

Credential Exposure Monitoring Continuous monitoring of dark web markets and stealer-log repositories for your organisation's exposed credentials.
Threat Hunting as a Service Proactive hunting for Amadey and StealC behaviours, including injection and browser-store access.
24/7 Incident Response Rapid containment and session invalidation when stealer activity is detected. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 11, 2026