StealC Malware Re-emerges as Stadia RAT, Offering Subscription-Based Credential Theft and Remote Control
The StealC malware has resurfaced as the Stadia RAT, a new remote access trojan offering subscription-based credential theft from over 50 browsers and hidden desktop control.
The threat actor behind the StealC malware has resurfaced with a new offering named Stadia, a sophisticated remote access trojan (RAT) for Windows systems. This new malware, advertised on October 16, 2026, combines extensive credential theft capabilities with hidden virtual network computing (HVNC), a remote command shell, file management, and a malware loader. The return of this threat actor follows the significant disruption caused by Operation Endgame in June, which saw authorities seize numerous servers and domains associated with StealC. Despite this takedown, the surviving code from StealC has provided a foundation for the seller to rebuild and rebrand their malicious operations.
Researchers from Varonis Threat Labs identified the direct lineage between Stadia and StealC after obtaining a sample of the new malware. Their analysis revealed a shared browser encryption helper, identical byte-for-byte with StealC 3.5, providing concrete evidence of code reuse. Stadia is modular, featuring six distinct components: a stealer for credentials, HVNC for covert desktop access, a remote command shell, a malware loader, a file manager, and a process manager. The HVNC module allows an operator to control a separate, hidden desktop session that the victim remains unaware of, significantly increasing the potential for undetected malicious activity.
The stealer component is particularly comprehensive, advertised to collect data from over 50 different web browsers, more than 120 cryptocurrency extensions, and approximately 50 desktop wallet applications. Beyond browser data, Stadia also targets information from messaging applications, gaming sessions, email clients, and VPN software. This broad scope of data collection, combined with remote access capabilities, presents a significant risk to individuals and organizations, extending beyond simple account compromise to potentially broader system infiltration.
Stadia is being offered through a subscription-based model, with pricing tiers designed to attract various levels of cybercriminals. Basic subscriptions cost $300 per month, Team subscriptions are $550, and the Pro version, which includes all six modules, is priced at $900 per month. To entice former StealC customers, the seller is offering a free month of the Pro version, leveraging existing relationships and the disruption of previous infrastructure to build a new customer base.
Technically, the examined Stadia sample is a 32-bit Windows executable that employs several evasion techniques. It uses RC4 encryption and Base64 encoding to obfuscate critical strings and resolves Windows functions dynamically during execution. Notably, the malware is designed to exit if it detects Russian, Ukrainian, Belarusian, Kazakh, or Uzbek language settings on the host system, a common tactic to avoid detection by researchers or actors in specific regions. Installation involves creating a random folder within Windows' shared application-data directory and using a filename that mimics legitimate software to blend in.
Persistence is achieved through a hidden scheduled task that runs at user logon and every 15 minutes. If the malware obtains elevated privileges, it also attempts to add its installation directory to Microsoft Defender exclusions via PowerShell, further hindering detection and removal efforts. For credential theft, Stadia injects code into suspended instances of browsers like Chrome, Edge, or Brave. It temporarily stores recovered browser encryption keys in a file before deleting it, a process that defenders can monitor.
Communication with command and control (C2) servers is conducted over HTTP using RC4-encrypted, Base64-encoded data, despite requests claiming to contain JSON. The malware contacts three hard-coded servers, with failover mechanisms in place. Varonis notes that server addresses and encryption keys change between builds, emphasizing the need for behavior-based detection methods rather than relying solely on static indicators like IP addresses or domain blocking. While the report details the malware's capabilities and technical implementation, it does not provide an independently verified infection count or specify the initial delivery vector.
The resurgence of StealC as Stadia RAT highlights the adaptive nature of cybercriminal operations. Despite law enforcement actions, the reuse of code and the shift to subscription models demonstrate the persistent threat posed by these malware-as-a-service offerings. Organizations should remain vigilant, monitor for suspicious browser injection, hidden scheduled tasks, and unauthorized antivirus exclusions, and prioritize behavior-based detection strategies to counter evolving threats like Stadia.