StealC Is Back, and This Time It's a RAT
Varonis analyzes Stadia RAT, the StealC successor combining credential theft, hidden desktop access, remote commands, and persistent malware capabilities.
The infamous StealC infostealer resurfaced four months after its takedown in Operation Endgame, now disguised as a remote access trojan (RAT) called Stadia. Europol dismantled StealC in June as part of the operation, seizing 326 servers and 142 domains, recovering over 25 million stolen credentials from 385,000 infected machines.
Now, the seller behind StealC has returned with Stadia, a full-fledged RAT offering hidden desktop control, live command shell, file explorer, process manager, and an in-memory loader. The RAT's features are similar to StealC's stealer, but the seller has added a variety of additional tools, including HVNC (Hidden Virtual Network Computing), Remote CMD, File Explorer, and Process Manager.
The seller is offering a free month on the Pro tier ($900) to former StealC customers, as every former customer is urged to make the switch. The listing for Stadia emphasizes its remote administration capabilities, with a module list that reads like a remote administration suite rather than an infostealer.
Written by urgent.news from HackerNoon's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
