StealC

The operations leverage agile evasion tactics, including top-level domain rotation, subdomain chaining... These attackers registered the same domain concept across multiple top-level domains, rotating as each is blocked.

Resource Development Acquire Infrastructure: Server T1583.004 BPH network via lir-ge-fast-1-MNT shell companies

victims searching for cracked versions of Adobe Photoshop and After Effects on YouTube, suggesting that YouTubeTA compromised legitimate YouTube channels with established subscriber bases to distribute StealC

The operator’s panel configuration included specific markers for studio.youtube.com credentials, indicating a strategy to hijack content creator accounts and expand malware distribution networks.

MITRE ATT&CK Mapping ... Resource Development Obtain Capabilities: Malware T1588.001 StealC v2 MaaS purchase/affiliation

The malware is distributed using the strategy of making the distribution posts appear at the top of search engine results (SEO poisoning).

ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver malware through the drive-by download technique.

Primarily via phishing emails, StealC malware uses fake CAPTCHA verification prompts and PowerShell scripts to bypass legitimate checks and steal information from the user.

Harden endpoints with application control for script interpreters and common living-off-the-land tools. Block or alert when browsers or explorer spawns cmd or PowerShell.

Once executed, the malware will launch PowerShell scripts that harvest credentials and other information from the affected user.

researchers discovered a cross-site scripting (XSS) vulnerability in its web panel following a code leak in spring 2025. By exploiting this flaw, CyberArk Labs collected system fingerprints, monitored active sessions, and captured authentication cookies

Dynamic API resolution GetProcAddress with obfuscated stack strings for sensitive APIs T1106

The attack flow involves a malicious JavaScript that redirects victims to a file-hosting page, which then delivers the StealC payload within a password-protected ZIP archive.

The dropper uses classic process hollowing (T1055.012) to execute the decompressed Stealc binary inside a legitimate Windows process.

MITRE ATT&CK Mapping Technique ID Usage Obfuscated Files or Information T1027 Custom 3-layer encryption, fake Raft types, English word obfuscation

MITRE ATT&CK Mapping Technique ID Usage Masquerading: Match Legitimate Name or Location T1036.005 intl.dll impersonating GNU libintl

The dropper uses classic process hollowing (T1055.012) to execute the decompressed Stealc binary inside a legitimate Windows process.

MITRE ATT&CK Mapping ... Defense Evasion Indicator Removal: File Deletion T1070.004 StealC self-terminates after exfiltration

MITRE ATT&CK Mapping ... Defense Evasion Deobfuscate/Decode Files T1140 Runtime RC4 decryption of config, strings, and overlay payload

MITRE ATT&CK Mapping ... Defense Evasion Virtualization/Sandbox Evasion T1497 IsDebuggerPresent, GetTickCount/QueryPerformanceCounter timing checks

Processor feature check IsProcessorFeaturePresent -- verifies AES-NI/SSE4.2, may detect VMs T1497.001

MITRE ATT&CK Mapping Technique ID Usage Reflective Code Loading T1620 Go-based reflective PE loader (both v1 and v2)

captured authentication cookies from the infrastructure designed to steal them... operators specializing in cookie theft failed to implement basic security features, such as the httpOnly flag, that would have prevented cookie hijacking via XSS attacks

MITRE ATT&CK Mapping ... Credential Access Credentials from Password Stores T1555 Browser credential database extraction

MITRE ATT&CK Mapping ... Credential Access Credentials from Web Browsers T1555.003 Chrome/Firefox/Edge password and cookie theft

MITRE ATT&CK Mapping ... Discovery System Information Discovery T1082 Hostname, username, OS version, installed software enumeration

MITRE ATT&CK Mapping ... Defense Evasion Virtualization/Sandbox Evasion T1497 IsDebuggerPresent, GetTickCount/QueryPerformanceCounter timing checks

Processor feature check IsProcessorFeaturePresent -- verifies AES-NI/SSE4.2, may detect VMs T1497.001

The system language discovery is a common CIS-region malware behavior: check the victim's language settings, and if the system is configured for Russian, Ukrainian, Belarusian, or another CIS-region language, terminate execution.

MITRE ATT&CK Mapping ... Collection Data from Local System T1005 File grabber, wallet data, application configs

MITRE ATT&CK Mapping ... Collection Screen Capture T1113 Multi-monitor screenshot capture

MITRE ATT&CK Mapping ... Collection Clipboard Data T1115 Clipboard monitoring for crypto addresses

When @Fact_Finder03 flagged 158.94.210[.]91 as a C2 panel... The /24 subnet surrounding that IP hosts 67 distinct command-and-control operations spanning 16 malware families.

C2 COMMUNICATION: HTTP POST to /410b5129171f10ea.php (RC4-encrypted body)

By hiding payloads inside images fetched from Bitbucket and triggering local execution through File Explorer, it slips past filters that expect obvious downloads or Run dialog abuse... Watch for image downloads followed by process creation or archive writes.

Exfiltration: HTTP POST to C2 gate... The body will be RC4-encrypted, appearing as binary data in a application/x-www-form-urlencoded content type.

EXFILTRATION: HTTP POST to C2 gate

Before injecting the stealer via process hollowing, it neutralizes AMSI by zeroing the AmsiScanBuffer prologue with embedded XOR-encoded shellcode.