Loading malware…
StealC is a Windows information-stealing malware family sold as a malware-as-a-service offering since early 2023 and commonly associated with a developer using the alias Plymouth. It is designed to harvest credentials and other sensitive data from infected systems and has been widely used in criminal intrusion chains, often alongside loaders such as Amadey, HijackLoader, CastleLoader, and ResiLoader. StealC has also been observed in broader ClickFix and fake verification campaigns, trojanized software distribution, and other commodity malware delivery operations.
StealC targets browser-stored data from Chromium-, Firefox-, Opera-, and Gecko-based applications, including saved logins, cookies, browsing history, autofill data, and payment card information. It also steals cryptocurrency wallet data from both local wallet applications and browser wallet extensions, and can collect Discord tokens, Telegram session data, Steam files, Outlook credentials, Pidgin data, qTox files, screenshots, system information, installed applications, running processes, and selected files based on operator-supplied rules. The malware can receive configuration from command-and-control infrastructure that defines browser targets, extension targets, wallet targets, and file collection criteria.
Technically, StealC uses obfuscation and dynamic API resolution, decrypts protected configuration data, and performs anti-analysis and anti-emulation checks. Reported behaviors include avoiding infection of systems configured for several CIS-region languages, enforcing single-instance execution, copying browser databases for offline access, using DPAPI and Chromium key material to decrypt protected browser secrets, and using NSS libraries to decrypt Firefox credentials. Stolen data is exfiltrated directly to command-and-control infrastructure during collection rather than being staged solely as raw local files.
In addition to information theft, StealC can function as a downloader by retrieving and executing additional payloads, making it useful as both a data-theft tool and a post-compromise enabler. It has been repeatedly linked to multi-stage attack chains in which another malware family establishes initial access or disables defenses before deploying StealC. Law-enforcement and industry disruption efforts in 2026 identified shared infrastructure between StealC and the Amadey malware ecosystem, underscoring its role in a broader cybercrime service stack used for credential theft, financial fraud, follow-on intrusion, and ransomware enablement.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Developer tools: n8n workflows, CCNA labs, 7-Zip CVE-2025-0411 PoC, Cursor.so, Sora AI
16 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023.
A user named @amdfx6300 on the Lolz Guru forum posted a thread titled “[LOGS] Dungeon Team Reborn · Stealc V2/Rhadamanthys · Fud Loader (0VT) / Fud Crypt | Seo Yt/Github.”
StealC, on the other hand, has leveraged various initial access vectors ranging from malware loaders (including Amadey) and ClickFix lures, and is equipped to extract sensitive information, such as screenshots, credentials, session cookies, autofill entries, credit card data, browsing history, and extension data. ... It also acts as a secondary loader, capable of downloading and executing EXE, MSI, or PowerShell payloads based on commands from an external server.
The group has been linked to past campaigns that delivered dangerous tools including NetSupport RAT, Remcos RAT, StealC, and Sectop RAT.
Diversified Malware Toolkit: Crazy Evil uses advanced tools like Stealc and AMOS for Windows and macOS, ensuring widespread compromise.
Amadey is a modular Windows botnet sold as MaaS by author "InCrease" on XSS/Exploit forums, active since 2018. It commonly drops Lumma, StealC, RedLine, CoinMiners, and RATs.
40 distinct techniques documented for this family, organized by ATT&CK tactic.
Operators distribute malware through pirated software repositories, malvertising networks, and compromised websites with the goal of infecting as many machines as possible.
This essentially retrieves the content from the specified URL and executes it directly in memory.
The downloaded content is piped ( | ) directly into another PowerShell instance using powershell - , which tells PowerShell to read and execute commands from standard input
"C:\Windows\system32\cmd.exe" / c timeout / t 5 & del / f / q "<Curren File Path" & del "C:\ProgramData\*.dll" & exit
Threat actors are abusing fake Google and Cloudflare verification pages in evolving ClickFix campaigns to socially engineer users into executing malicious commands on their own systems.
We can see a number of techniques implemented here: case‐altered obfuscation string splitting obfuscation
Stealc has no static imports so it dynamically resolves the required APIs using GetProcAddr() API... it first gets PEB address then from, PEB it accesses Ldr structure... kernel32.dll base address in memory.
The part after the semicolon ( ; ) - 🌐 Access Guard: Validation. RefID: 45ab26cf05b6abc95f is not executed. It’s simply a comment , used as social engineering to make the command look like a benign system message.
Stealc deletes the downloaded Dlls, removes itself from the machine, and exits the process. "C:\Windows\system32\cmd.exe" / c timeout / t 5 & del / f / q "<Curren File Path" & del "C:\ProgramData\*.dll" & exit
It then proceeds by decoding the byte array, decrypting it within a for loop, and invoking it in memory.
curl.exe is used with the -k (ignore certificate errors), -L (follow redirects), and --retry 999 (try up to 999 times) options to fetch a remote payload
Stealc will start to check if it’s running under Emulation Environment... check API Emulation Check memory status Check computer and user names check Compilation time
Stealc checks the Emulation by calling this VirtualAllocExNuma API... GlobalMemoryStatusEx... GetComputerName and GetUserNameA... compare them against those used by Windows Defender in its Emulator HAL9TH ... JohnDeo
Expiration check: there is a fixed time and if you try to run it after this time it will exit and do nothing This is achieved by calling GetSystemTime API
The second tool is called StealC, it is an infostealer-as-a-service tool that steals cryptocurrency wallets, browser extensions, authentication cookies, and login credentials.
it gets the path of the Steam folder using the Registry... HKEY_CURRENT_USER\Software\Valve\Steam... retrieves the path using RegQueryValueExA
Stealc starts gathering system and hardware information like... running process
Stealc starts gathering system and hardware information like, ip address country processor name operating system arch 32 or 64 pc or laptob UserName computerName Screenshot installed apps running process
it will iterate over these folders and subfolders... Desktop APPDATA\Romaing APPDATA\Local Document ProgramFiles ProgramFiles x86 Recent
Stealc will start to check if it’s running under Emulation Environment... check API Emulation Check memory status Check computer and user names check Compilation time
Stealc checks the Emulation by calling this VirtualAllocExNuma API... GlobalMemoryStatusEx... GetComputerName and GetUserNameA... compare them against those used by Windows Defender in its Emulator HAL9TH ... JohnDeo
Expiration check: there is a fixed time and if you try to run it after this time it will exit and do nothing This is achieved by calling GetSystemTime API
Stealc starts gathering system and hardware information like... installed apps
it will iterate over these folders and subfolders, if it finds any file that contains any string of those which was sent from C2 like “seed”, “passphrase”,” MetaMask” etc.., it will read its content and send it to C2
Microsoft has disrupted over 200 C2 servers and shut down criminal control of over 18,000 compromised computers.
It will connect with the C2 and prepare the request then the malware will send the packet to C2 using HttpSendRequest
497 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An infostealer mentioned as an example of live C2 infrastructure tracked by Hudson Rock Threat Feeds.
Mentioned only as an example of another tag that should reduce confidence when attributing activity to Kratos.
STEALC9
StealC is described as an infostealer-as-a-service malware used to steal cryptocurrency wallets, browser extension data, authentication cookies, and login credentials. The content says it is often used alongside Amadey as part of a cybercrime chain.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.