StealC info-stealer

It is reported that StealC is an active Malware-as-a-Service (MaaS) information-stealing malware that has been used by cybercriminals since 2023 to compromise Windows systems and exfiltrate sensitive information. Designed to steal credentials, browser cookies, authentication tokens, autofill data, cryptocurrency wallet information and other confidential data, StealC has evolved rapidly with enhanced evasion capabilities and modular functionality. In addition to information theft, the malware can also download and execute additional payloads, making it a significant threat that may facilitate further malicious activities, including remote access and ransomware deployment.

Infection Mechanism:

StealC is primarily distributed through phishing emails, malicious advertisements, compromised websites, fake software downloads, cracked software and other malware loaders. Victims are lured into executing a malicious file disguised as legitimate software or an update. Once executed, the malware establishes communication with attacker-controlled Command-and-Control (C2) servers to receive configuration data and initiate data theft. It collects credentials, browser data, session cookies, cryptocurrency wallet information and other sensitive files before transmitting the stolen data to the C2 server. Recent variants also support downloading and executing additional malware, while employing techniques such as encrypted communications, code obfuscation and anti-analysis measures to evade detection and prolong attacker access to the compromised system.

Recommended Mitigation Measures:

• Enforce Multi-Factor Authentication (MFA)
  • Enable MFA for all accounts wherever applicable.
  • Prefer hardware security keys, authenticator apps (TOTP) or certificate-based authentication over SMS-based MFA, which is less secure.
• Rotate credentials regularly
  • Require periodic password changes for privileged accounts per policy.
  • Immediately rotate any credentials that may have been exposed or are suspected compromised.
  • Use long, strong and unique passwords. Do not reuse passwords across systems.
• Remove unknown accounts
  • Identify and delete any unrecognized or unnecessary user accounts.
  • Review user roles and privileges. Restrict administrative rights to designated personnel only.
• Treat browser pop‑ups and unsolicited update prompts as untrusted
  • Never trust browser pop-ups that request software updates or immediate action.
  • Be especially suspicious of prompts that are overly flashy or pressure users to act immediately.
• Use official update channels
  • Obtain updates only through the operating system’s update mechanism, the application’s built‑in updater or the official app store.
  • Do not download updates from third party websites or links in unsolicited emails/messages.
• Maintain endpoint protection
  • Ensure all endpoints have an up-to-date antivirus/antimalware solution enabled at all times.
  • Scan new installations and downloaded files before running them. Keep signature and engine updates current.
• Users are advised to disable their RDP if not in use, if required, it should be placed behind the firewall and users are to bind with proper policies while using the RDP.
• Don't open attachments in unsolicited e-mails, even if they come from people in your contact list and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization’s website directly through browser.

References:

• https://community.hpe.com/t5/hpe-threat-labs/stealc-malware/ba-p/7267253
• https://www.huntress.com/threat-library/malware/stealc
• https://www.zscaler.com/blogs/security-research/i-stealc-you-tracking-rapid-changes-stealc
• https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/
• https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/