StealC Malware Returns as New Stadia RAT to Steal Passwords and Secretly Control Windows PCs

The seller behind StealC has returned with Stadia, a Windows remote access trojan that combines password theft with hidden desktop control.

Advertised on October 16, 2026, the malware expands beyond stealing data, allowing criminals to run commands, browse files, manage processes, and load more malicious software.

The return follows June’s Operation Endgame disruption. Authorities seized 326 servers and 142 domains, according to Varonis.

Although the earlier StealC infrastructure takedown disrupted the criminal service, its surviving code gave the seller a foundation for rebuilding under a new name.

Researchers from Varonis Threat Labs identified Stadia’s connection to StealC after obtaining a build, examining its code, and testing its web panel against their own Windows machine.

Their technical analysis of Stadia found an embedded browser encryption helper shared byte for byte with StealC 3.5, providing direct evidence of code reuse.

StealC Malware Returns as New Stadia RAT

Stadia brings together six modules: a stealer, hidden desktop access, a remote command shell, a loader, a file explorer, and a process manager.

Hidden Virtual Network Computing, or HVNC, lets an operator work inside a separate desktop that the victim cannot see. The file tools support uploads, downloads, and execution.

The seller advertises collection from more than 50 browsers, 120 cryptocurrency extensions, and 50 desktop wallets. Targets also include messaging apps, gaming sessions, email clients, and VPN software.

Similar combinations appear in Dolphin X credential theft coverage, where stolen browser data and remote access create risks beyond individual account losses.

Monthly subscriptions cost $300 for Basic, $550 for Team, and $900 for Pro. Only Pro includes all six modules. Former StealC customers receive a free Pro month, helping the seller attract buyers whose previous infrastructure disappeared. The tested panel and agent both reported version 1.1.2.

How Stadia Hides and Communicates

The examined sample is an unsigned, 560,128-byte, 32-bit Windows executable built with Microsoft Visual C++. It hides important strings using RC4 encryption and Base64 encoding, while resolving most Windows functions during execution.

It also exits when certain Russian, Ukrainian, Belarusian, Kazakh, or Uzbek language settings are detected. Installation creates a random folder beneath Windows’ shared application-data directory and uses a filename resembling legitimate software.

A hidden scheduled task runs at logon and every 15 minutes. With elevated permissions, Stadia also adds its installation folder to Microsoft Defender exclusions through PowerShell.

For browser theft, an unsigned process starts Chrome, Edge, or Brave in a suspended state and injects roughly 26 KB of code. A temporary text file briefly holds the recovered browser encryption key before deletion.

Related ChonkyChicken browser credential attacks show why protected browser storage remains an important monitoring target. Stadia contacts three hard-coded servers over HTTP.

Its requests claim to contain JSON, but actually carry RC4-encrypted, Base64-encoded data. Defenders should investigate this mismatch alongside suspicious browser injection, hidden tasks, and new antivirus exclusions.

Varonis warns that server addresses and keys change between builds, making behavior-based detection more durable than static blocking alone. The report does not establish an initial delivery method or independently verified infection count.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post StealC Malware Returns as New Stadia RAT to Steal Passwords and Secretly Control Windows PCs appeared first on Cyber Security News.