What is StealC? A guide for security teams.
StealC is a Windows information stealer first advertised on January 9, 2023 on Russian-speaking underground forums by an actor using the handle Plymouth [1]. Sekoia described it as a ready-to-use stealer sold as malware-as-a-service, which the seller said was built using code from the Vidar, Raccoon, Mars and RedLine stealers [1]. Affiliates build their own samples and manage stolen data from a web panel [4]. Besides stealing data, StealC can download further payloads; Proofpoint observed StealC clients fetching other malware, including a loader that delivered LockBit Black ransomware [6].
How StealC operates.
Version 2 appeared in March 2025 with a redesigned panel and broader data theft [2], and Trend Micro reported that former Lumma Stealer customers moved mainly to Vidar and StealC in late 2025 [3]. Microsoft linked StealC and the Amadey loader to more than 140,000 infected computers worldwide in the first two weeks of May 2026 [5]. On June 24, 2026, Europol announced an Operation Endgame action against SocGholish, Amadey and StealC in which 326 servers and 142 domains were actioned and about 27 million stolen credentials were recovered, alongside a Microsoft Digital Crimes Unit action against StealC and Amadey infrastructure [4] [5].
What StealC steals.
- Saved browser credentials and autofill data [4] [6]
- Browser cookies and tokens [6]
- Saved payment card data [4]
- Cryptocurrency wallets and wallet browser extensions [1] [4]
- Email client data such as Outlook and Thunderbird, and messaging apps [6]
- VPN, FTP and cloud credentials, including OpenVPN, FileZilla, WinSCP and Azure [6]
- Screenshots and files matching operator-defined search rules [1] [2]
How it spreads.
- Delivery by the Amadey loader [2] [4]
- Search engine poisoning and malicious ads for fake or cracked software and game cheats [4]
- ClickFix prompts that trick users into running commands, and phishing email [4]
- YouTube videos that link to fake cracked-software download sites [1]
- Loaders such as CastleLoader [8]
Notable events.
StealC is advertised on January 9 on the XSS and BHF underground forums [1].
Sekoia reports StealC gaining popularity, with 35 active command servers and samples spread via fake cracked software [1].
StealC V2 is released with a redesigned control panel and expanded data theft [2].
Trend Micro reports former Lumma Stealer customers migrating mainly to Vidar and StealC [3].
Microsoft links StealC and Amadey to more than 140,000 infected computers in the first two weeks of May [5].
Operation Endgame and Microsoft's Digital Crimes Unit disrupt StealC and Amadey infrastructure, announced June 24 [4] [5] [7].
If an employee device was infected.
Stolen session cookies can let an attacker skip passwords and MFA, so a password reset alone is not enough.
- Isolate the infected device and reimage it; StealC can download additional malware, including ransomware loaders, so check for follow-on payloads [6].
- Assume every account ever used on the device is compromised, not only the one in an alert, and change those credentials from a clean device [7].
- Revoke sessions and refresh tokens for affected users in your identity provider and SaaS apps, since stolen cookies and tokens can be reused without a password.
- Rotate VPN, FTP, cloud and API credentials that were stored on or used from the device.
- Review sign-in, MFA registration and mailbox rule changes for the affected accounts since the likely infection date.
- Check whether the user's credentials appear in the dataset recovered by Dutch police at politie.nl/checkyourhack [7].
- Restrict installation of unapproved software, and enable two-factor authentication wherever possible [7].
Is StealC still active after Operation Endgame?
StealC's infrastructure was disrupted on June 24, 2026 [4] [5]. Its developers had released version 2.22.0 on May 26, 2026 [6], and other stealers such as Lumma have rebuilt after past takedowns, so organizations should keep treating it as a live threat [3].
How is StealC related to Vidar and Raccoon?
Its seller said StealC was built using code from Vidar, Raccoon, Mars and RedLine, and Sekoia found its command-and-control traffic resembled Vidar and Raccoon [1].
Can StealC steal browser cookies and passwords?
Yes. Proofpoint and Microsoft report that StealC collects browser credentials, cookies, tokens, autofill and card data [4] [6].
How do I know if my organization's credentials were in the StealC data?
Dutch police published a lookup at politie.nl/checkyourhack for the credentials recovered in the operation, and advise changing the logins of every account used on an infected device [7].
Research behind this guide.
By the Vuxep team. Reviewed October 19, 2026. Products, plans, and threat activity change; check the original source for current details.
- Sekoia: Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity, Part 1 (February 20, 2023)
- Zscaler ThreatLabz: I StealC You: Tracking the Rapid Changes to StealC (May 1, 2025)
- Trend Micro: Shifts in the Underground: The Impact of Water Kurita's (Lumma Stealer) Doxxing (October 16, 2025)
- Microsoft Security Blog: StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them (June 24, 2026)
- Europol: Global cyber strike disrupts SocGholish, Amadey and StealC malware networks (June 24, 2026)
- Proofpoint: StealC You Later: Proofpoint and IBM X-Force Support Operation Endgame Disruptions (June 24, 2026)
- Politie (Dutch National Police): Operation Endgame: two infostealers taken down again (June 24, 2026)
- BleepingComputer: LummaStealer infections surge after CastleLoader malware campaigns (February 11, 2026)
Compare infostealer families.
Find stolen work
credentials first.
Vuxep indexes credentials from stealer logs and alerts your team when accounts on your verified domains appear. See the workflow in a walkthrough.