Loading story…
Cybersecurity researchers disclosed a persistent cross-site scripting (XSS) vulnerability in the web-based administration panel used to operate the StealC information-stealer, enabling defenders to compromise the criminals’ own management interface. CyberArk researcher Ari Novick reported that insufficient input sanitization in the panel allowed injected JavaScript to execute in authenticated operator sessions, which in turn enabled collection of system fingerprints, monitoring of active/live sessions, and exfiltration of session cookies from StealC operators.
Reporting indicates the access provided unusual visibility into StealC operator tradecraft and operational security failures, including the ability to infer operator environment details (e.g., IP/location and hardware characteristics when an operator accessed the panel without a VPN). StealC has been active since January 2023 as a malware-as-a-service (MaaS) stealer and has been distributed via multiple lures and channels (including YouTube-based distribution and other social-engineering delivery methods); recent iterations included panel redesigns and added features such as Telegram notifications, and a subsequent leak of the panel source code helped create conditions for researchers to identify and exploit weaknesses in the operator infrastructure while withholding full exploit specifics to avoid rapid patching or copycat abuse.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
On January 19, 2026, multiple reports described CyberArk's disclosure of the StealC admin panel XSS issue and the operational insights it yielded into StealC users. As of the disclosure, there was no public confirmation that the vulnerability had been patched.
Using the panel flaw, researchers collected browser and system fingerprints, exfiltrated session cookies, and impersonated operators to observe backend activity such as reviewing stolen credentials and managing infected endpoints. Their investigation also profiled the active operator "YouTubeTA" and found no evidence that APT groups had exploited this specific XSS.
CyberArk researcher Ari Novick identified a persistent XSS vulnerability in the StealC web-based control panel caused by insufficient sanitization of user-supplied input. The flaw allowed code execution in authenticated operator sessions.
In mid-July 2025, the operator dubbed "YouTubeTA" reportedly failed to use a VPN, exposing a real IP address linked to Ukrainian ISP TRK Cable TV. The mistake supported an assessment that the actor was likely a Russian-speaking individual in Eastern Europe.
After the release of StealC V2, its panel source code was leaked, giving researchers the ability to analyze the malware operators' backend environment and identify weaknesses. This leak enabled later investigation of the panel's XSS flaw.
StealC version 2.0 introduced a redesigned administration panel and features including Telegram bot notifications. The vulnerable admin panel version confirmed by researchers was released in April 2025.
During 2025, a StealC operator tracked as "YouTubeTA" used hijacked YouTube accounts to promote fake cracked software, including pirated Adobe tools, to distribute the malware. The activity appeared aimed in part at stealing YouTube creator accounts to expand propagation.
StealC, a malware-as-a-service information stealer, was first seen in January 2023. It later spread through lures such as cracked software, rogue files, and fake CAPTCHA-style social engineering.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
rescana.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed the **StealC** infostealer as a growing malware family sold on underground forums and operated through self-hosted PHP-based panels, with public and customized private variants reportedly available to customers. Reverse-engineering reports show StealC using anti-analysis checks, dynamic API resolution, and layered string protection including **RC4+Base64** and **XOR** decryption, while packed samples used the `pkr_ce1a` loader with **TEA-based** decryption and anti-emulation logic. Analysts also published tooling and detection content, including YARA coverage, IDA and Binary Ninja automation, and configuration extraction methods that help recover embedded indicators from samples. The malware was shown stealing browser credentials, application logins, cryptocurrency wallet data, system information, plugins, and selected files before exfiltrating the data over **HTTP** in multipart requests. Multiple analyses tied samples to command-and-control infrastructure including `185.172.128.59` serving `ISetup8.exe`, `185.172.128.150` with the path `/b7d0cfdb1d966bdd/c698e1bc8a2f5e6d.php`, and `94.131.107.238` with `/3aa13fff14e398a1.php`; one observed sample also downloaded and executed a **Laplas Clipper** as a next-stage payload. The combined findings indicate that StealC remains an adaptable credential-theft platform with evolving packing, configurable infrastructure, and support for follow-on malware delivery.
Aug 15, 2026
Researchers uncovered a newly identified malware-as-a-service operation called **Evil Stealer** after its backend infrastructure was left exposed on Njalla-hosted systems, including an unauthenticated status API on port `8888` and a raw Next.js panel on port `3000`. The exposed API revealed a sequential counter showing **310,194 processed credential logs** within roughly six days, while the panel’s JavaScript also contained a cryptocurrency wallet drainer. Investigators linked the operation to domains including `evilmirror[.]net` and `ofmhubintel[.]com`, the latter tied to an **OnlyFans creator scraper**, indicating the actor was pursuing multiple monetization streams beyond credential theft. The operator was identified with high confidence through poor operational security in a promotional video whose unstripped XMP metadata exposed the Windows username **"moros"**, a Russian-language filename, and timestamps consistent with **UTC+3 / Moscow time**. Additional artifacts, including Russian keyboard indicators, shared registrar and hosting details, matching SSH HASSH fingerprints, and common Ubuntu templates, supported the assessment that the same Russian-speaking actor ran the linked infrastructure. Researchers also observed nearby suspicious services on the same hosting environment, including phishing and TLS interception infrastructure, although attribution for those adjacent systems was weaker; the malware payload and delivery chain for Evil Stealer itself had not yet been publicly identified.
Jun 29, 2026
The source code for **Titan Stealer**, a Windows information-stealing malware family sold through a Russian-language Telegram channel, was publicly exposed on GitHub, where a repository advertised the **full server, client, and admin panel**. The leaked project was described as written in **C#/.NET** with a **PHP** administration panel and promoted capabilities to harvest data from more than **70 browsers** and **70 cryptocurrency wallets**, alongside file-grabber functions and server-side decryption. Security research shows Titan Stealer uses a **32-bit GCC-compiled loader** to decrypt an embedded **Golang** payload and inject it into `AppLaunch.exe` via process hollowing. Once active, it steals browser credentials, cryptocurrency wallet data, **Telegram Desktop** artifacts, FTP client details, screenshots, system information, and selected files, then exfiltrates the data to command-and-control infrastructure as a **base64-encoded archive**. Researchers said the operators actively maintained the malware, marketed updates and bug fixes, and used a dedicated panel to review victim logins and stolen data.
Aug 15, 2026