credential-stealer-activitycybercrime-service-ecosystemcommand-and-control-methoddefense-evasion-method

Stealc Infostealer Gains Adoption Alongside RedLine, MetaStealer and Agent Tesla

Malware Intelligence · 5 sources · Updated 2mo ago · First seen Jan 9, 2023

Stealc, a malware-as-a-service Windows information stealer advertised on Russian-speaking cybercrime forums in January 2023, rapidly gained criminal adoption. The malware borrows capabilities and design elements from Vidar, Raccoon, Mars, and RedLine, stealing browser credentials and cookies, cryptocurrency-wallet data, desktop-wallet files, and information from Discord, Telegram, Outlook, Steam, and Tox. Researchers observed more than 40 samples and at least 35 active command-and-control servers, with campaigns using YouTube videos and cracked-software downloads as lures.

Stealc uses RC4 and Base64 string obfuscation, dynamic API resolution, sandbox checks, staged C2 tasking, and self-deletion following exfiltration. It is part of a broader active ecosystem of Windows stealers including RedLine, MetaStealer, and Agent Tesla: RedLine dominated observed telemetry during 2022–2023, while Agent Tesla activity increased through 2024. Defenders should prioritize detection of suspicious access to browser credential stores and cryptocurrency-wallet files, as well as unsigned executables communicating with Telegram or Discord infrastructure.

Hunt this familyPull IOCs and campaign context straight into your stack.

Get the IOCs

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

7 events · 2020 – Feb 2023

Reported May 24, 20242y ago
Agent Tesla activity spikes in Elastic telemetry
Elastic telemetry covering 2023 to 2024 showed a notable increase in Agent Tesla activity, with RedLine, Stealc, and Vidar following it in observed prevalence.
Globally distributed stealers
Reported Feb 20, 20234y ago
Stealc rapidly gains criminal adoption
Sekoia.io observed several dozen Stealc samples and more than 40 associated C2 servers, including 35 active C2 servers identified with high confidence, indicating rapid adoption by cybercriminals.
Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity - Part 1
Feb 2023
Sekoia identifies Stealc samples in the wild
While tracking infostealer distribution infrastructure, Sekoia.io found a new malware family and assessed with high confidence that it was Stealc based on matching technical characteristics and C2 communications.
Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity - Part 1
Jan 9, 20234y ago
Plymouth advertises Stealc on cybercrime forums
A threat actor using the handle Plymouth advertised the Stealc malware-as-a-service stealer on the Russian-speaking XSS and BHF underground forums, later promoting it through Exploit and Telegram.
Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity - Part 1
Reported May 24, 20224y ago
Elastic adds YARA detection for a new Stealc sample
Elastic Security created the Windows_Trojan_Stealc_df3cdc7e YARA rule to detect an x86 Stealc sample identified by SHA-256 503879c9c294cd7a2b7b13c643b93d8a8e7ae00af5b2b56fcbb90e6c096f40d6. The rule uses a specified byte pattern to scan Windows files and memory.
protections-artifacts/yara/rules/Windows_Trojan_Stealc.yar at main · elastic/protections-artifacts · GitHub
2022
MetaStealer emerges as a RedLine derivative
MetaStealer emerged and was advertised as a RedLine-derived information stealer with additional capabilities.
Globally distributed stealers
2020
RedLine information stealer debuts
The RedLine Windows information stealer debuted and was initially distributed through email. It later operated as a malware-as-a-service offering sold on underground forums.
Globally distributed stealers

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

4 linked

StealC Agent Tesla RedLine MetaStealer

Observables

142 linked

URLhttps://•••••.•••/••••IPv4 address•••.•••.••.•••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Domain•••••••••.netURLhttps://•••••••••.•••/••••IPv4 address•••.•••.••.•••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Domain••••••.ru+134

Indicator values are masked on this page. View all 142 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

Elastic Security LabsNews · Jan 1, 2026

Elastic Defend integration | Elastic integrationsOpen source ↗

MalpediaNews · Aug 28, 2025

MetaStealer (Malware Family)Open source ↗

Elastic Security LabsNews · May 24, 2024

Globally distributed stealersOpen source ↗

Sekoia BlogNews · Feb 20, 2023

Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity - Part 1Open source ↗

Github WebNews · May 24, 2022

protections-artifacts/yara/rules/Windows_Trojan_Stealc.yar at main · elastic/protections-artifacts · GitHubOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

credential-stealer-activitycybercrime-service-ecosystemcommand-and-control-methoddefense-evasion-method

Stealc Infostealer Gains Adoption Alongside RedLine, MetaStealer and Agent Tesla

Malware Intelligence · 5 sources · Updated 2mo ago · First seen Jan 9, 2023

Hunt this familyPull IOCs and campaign context straight into your stack.

Get the IOCs

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

7 events · 2020 – Feb 2023

Reported May 24, 20242y ago
Agent Tesla activity spikes in Elastic telemetry
Elastic telemetry covering 2023 to 2024 showed a notable increase in Agent Tesla activity, with RedLine, Stealc, and Vidar following it in observed prevalence.
Globally distributed stealers
Reported Feb 20, 20234y ago
Stealc rapidly gains criminal adoption
Sekoia.io observed several dozen Stealc samples and more than 40 associated C2 servers, including 35 active C2 servers identified with high confidence, indicating rapid adoption by cybercriminals.
Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity - Part 1
Feb 2023
Sekoia identifies Stealc samples in the wild
While tracking infostealer distribution infrastructure, Sekoia.io found a new malware family and assessed with high confidence that it was Stealc based on matching technical characteristics and C2 communications.
Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity - Part 1
Jan 9, 20234y ago
Plymouth advertises Stealc on cybercrime forums
A threat actor using the handle Plymouth advertised the Stealc malware-as-a-service stealer on the Russian-speaking XSS and BHF underground forums, later promoting it through Exploit and Telegram.
Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity - Part 1
Reported May 24, 20224y ago
Elastic adds YARA detection for a new Stealc sample
Elastic Security created the Windows_Trojan_Stealc_df3cdc7e YARA rule to detect an x86 Stealc sample identified by SHA-256 503879c9c294cd7a2b7b13c643b93d8a8e7ae00af5b2b56fcbb90e6c096f40d6. The rule uses a specified byte pattern to scan Windows files and memory.
protections-artifacts/yara/rules/Windows_Trojan_Stealc.yar at main · elastic/protections-artifacts · GitHub
2022
MetaStealer emerges as a RedLine derivative
MetaStealer emerged and was advertised as a RedLine-derived information stealer with additional capabilities.
Globally distributed stealers
2020
RedLine information stealer debuts
The RedLine Windows information stealer debuted and was initially distributed through email. It later operated as a malware-as-a-service offering sold on underground forums.
Globally distributed stealers

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

4 linked

StealC Agent Tesla RedLine MetaStealer

Observables

142 linked

URLhttps://•••••.•••/••••IPv4 address•••.•••.••.•••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Domain•••••••••.netURLhttps://•••••••••.•••/••••IPv4 address•••.•••.••.•••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Domain••••••.ru+134

Indicator values are masked on this page. View all 142 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

Elastic Security LabsNews · Jan 1, 2026

Elastic Defend integration | Elastic integrationsOpen source ↗

MalpediaNews · Aug 28, 2025

MetaStealer (Malware Family)Open source ↗

Elastic Security LabsNews · May 24, 2024

Globally distributed stealersOpen source ↗

Sekoia BlogNews · Feb 20, 2023

Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity - Part 1Open source ↗

Github WebNews · May 24, 2022

protections-artifacts/yara/rules/Windows_Trojan_Stealc.yar at main · elastic/protections-artifacts · GitHubOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Stealc Infostealer Gains Adoption Alongside RedLine, MetaStealer and Agent Tesla

How this story unfolded

Agent Tesla activity spikes in Elastic telemetry

Stealc rapidly gains criminal adoption

Sekoia identifies Stealc samples in the wild

Plymouth advertises Stealc on cybercrime forums

Elastic adds YARA detection for a new Stealc sample

MetaStealer emerges as a RedLine derivative

RedLine information stealer debuts

Related entities

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

SantaStealer Infostealer Rebrands and Targets Cryptocurrency Assets

RedLine Stealer spreads through phishing, fake software, and malware loaders

StealC Infostealer Expands With Obfuscated Loaders, Broad Data Theft, and Active C2s

Stealc Infostealer Gains Adoption Alongside RedLine, MetaStealer and Agent Tesla

How this story unfolded

Agent Tesla activity spikes in Elastic telemetry

Stealc rapidly gains criminal adoption

Sekoia identifies Stealc samples in the wild

Plymouth advertises Stealc on cybercrime forums

Elastic adds YARA detection for a new Stealc sample

MetaStealer emerges as a RedLine derivative

RedLine information stealer debuts

Related entities

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

SantaStealer Infostealer Rebrands and Targets Cryptocurrency Assets

RedLine Stealer spreads through phishing, fake software, and malware loaders

StealC Infostealer Expands With Obfuscated Loaders, Broad Data Theft, and Active C2s