What is StealC?
StealC was first reported in 2023 by Sekoia researchers, it was offered in underground forums such as XSS and BHF, and advertised as a powerful stealer with broad capabilities of information harvesting and payload execution. In the listing in said forums, plymouth, its creator, explained using other commodity stealers, namely Vidar, Raccoon, Mars, and Redline, as inspiration and foundation for StealC. The stealer targets browser credentials, cookies, user autofill data, cryptocurrency wallets, email clients, VPN clients, and more with the goal of exfiltrating the stolen goods to an attacker-controlled server. In addition to the harvesting capabilities StealC can also serve as an initial-access vector for follow-up attacks and payload execution.
The phenomenon of stealers being sold as commodities in clandestine attacker forums has become highly prevalent in the cybercrime ecosystem, much due to the vast flexibility and customization these stealers offer. Although the authors of these stealers more often than not reuse code infrastructure seen in other stealers, they still go to great lengths to maintain and improve the stealers over time. Such is the case with StealC which remains under active development as reported on by Zscaler in May 2025. An interesting development occurred a month ago for StealC and its users: Microsoft in collaboration with Europol and other industry partners, launched a disruption operation with the goal of seizing critical infrastructure to interrupt the operational leverage of StealC. The operation carried out combined court orders, domain takedowns, and C2 servers seizure to destabilize the infrastructure. This operation represents a significant win for the defender community, but for companies the risk remains ever present. If a threat actor manages to comprise even a junior employee it could put at stake an entire organization.
Capabilities
StealC’s V1 capabilities were by no means short or limited. Nevertheless, up until March of 2025 StealC’s creator continued to maintain the stealer offering a modernized and more robust product in StealC V2.
Capabilities retained
- Browser credentials, cookies, autofill, and credit card theft
- Cryptocurrency browser extension and desktop wallet theft
- Messaging app data theft (tokens, sessions, configs, credentials): Discord, Telegram, Tox
- Email client credential theft: Outlook, Thunderbird, Foxmail, The Bat!
- FTP/SFTP client credential theft: FileZilla, WinSCP
- VPN credential theft: OpenVPN, NordVPN, ProtonVPN
- Gaming application data theft
- EXE payload execution
- Self-deletion after exfiltration (no persistence)
New or improved capabilities
- Unified file grabber controlled via C2 commands
- Multi-monitor screenshot capture
- MSI and PowerShell payload execution
- RC4-encrypted C2 communications
- JSON-based C2 protocol with access tokens
- Enhanced operator panel:
- Deliver EXE, MSI, or PowerShell payloads
- Victim targeting (geolocation, HWID, installed software)
- Configurable data collection via unified file grabber
- Configurable self-deletion, screenshots, and C2 settings
Overall, the evolution focuses on hardening detection by security tools, improving usability for robust customization including credential validation, and generally offering a more flexible delivery platform. Theft capabilities remain similar to those implemented since its inception.
import "pe"
rule StealC_Stealer {
meta:
author = "Evelyne Diaz Araque (evadiaz@stairwell.com)"
date = "2026-06-18"
description = "Detects StealC V2 stealer based on builder source path and other unique identifying features."
hash0 = "57f405a79c05d01e730b08c35527262be1245fcea1c937633673073631137b3a"
hash1 = "e8a284e49ade54cecf95fb9f00e03ffc5270a2c8794c36d40c85243b81cf37bf"
hash2 = "f1daaa486a6448ed60fddd5a2bae1ebafb4d97c28cae61f9c6197ff449eb7efd"
strings:
$s0 = "C:\\builder_v2\\stealc\\json.h" ascii wide
$s1 = "minkernel\\crts\\ucrt\\inc\\corecrt_internal_strtox.h" ascii wide
$f = "steal_" ascii wide
condition:
pe.is_pe and
($s0 and $s1) or
(all of ($s*) and $f)
}
Conclusion
Despite the coordination disruption efforts of StealC’s infrastructure, the malware remains a relevant threat. Its continued development from V1 to V2 demonstrates the maturity of the Malware-as-a-Service (MaaS) ecosystem, where operators prioritize improved usability, stealth, and operational efficiency while retaining core functionality that solidified the stealer as successful.
For defenders, this highlights the importance of continuously detecting and monitoring malware to understand its evolution and measure its impact over time. Stairwell enables this by preserving files indefinitely, continuously re-analyzing a multi-petabyte malware corpus as new intelligence becomes available, and automatically running YARA hunts against each organization’s private file vault to identify newly relevant threats.
Want to see it in action? Reach out to our team to learn more – Request a Demo