Can StealC infections be prevented, and does early detection still matter?

Prevention should be the primary focus. Mandiant M-Trends 2026 documents a median of 22 seconds between initial access and handoff to a secondary threat group in 2025, which leaves defenders almost no realistic window to detect and respond once that handoff begins. This makes blocking the delivery vector, ClickFix and FileFix lures, malicious Amadey payloads, poisoned loaders, and unpatched exposure, far more effective than relying on detection alone. Detection still has value as a second layer and for identifying infections that predate the handoff. Look for unexpected network requests to unfamiliar domains and repeated HTTP POSTs containing small, RC4- or Base64-encoded JSON chunks. On endpoints, monitor for PowerShell or Go scripts launched from the Win+R dialog or the File Explorer address bar. Behavioral anomalies such as multimonitor screenshot capture and access to browser cookie databases are also StealC indicators, but should be treated as confirmation of a problem that prevention already should have stopped.

What registry or file artifacts does StealC leave behind?

StealC is nonresident and often self-deletes after exfiltration, but it may modify the Windows registry to disable security tools or alter boot settings. Investigators should review the UserAssist and Run keys for unusual entries and look for temporary files or scheduled tasks associated with random-named executables.

Do I need to reset passwords and session cookies after a StealC incident?

Yes. StealC harvests saved passwords and session cookies from more than 23 browsers and can steal authentication tokens that bypass multifactor authentication. After eradicating StealC, you must invalidate all session tokens and reset passwords for services accessed from the infected machine. Rotate API keys, cloud access tokens and SSH keys, and enable device-based verification where possible to prevent reused sessions from being exploited.

Can StealC steal cryptocurrency or browser-stored wallets?

Yes. StealC's file-grabber and credential-harvesting modules target browser databases and credential files, including browser-based cryptocurrency wallets and keystore files. Attackers value cryptowallets because they provide direct, irreversible monetary gain. Organizations and individuals using browser wallets should export private keys to hardware wallets and remove them from browsers where possible.

Is StealC still active after the June 2026 disruption, and how frequently is it updated?

Yes. Microsoft's June 24, 2026 disruption action, conducted with Europol, took down more than 200 StealC and Amadey C2 domains and IPs, but it targeted shared infrastructure rather than the StealC operation itself. The developer, known as “Plymouth,” has historically maintained a fast release cadence with regular changelogs and feature updates, and MaaS operators typically rebuild infrastructure within weeks of a disruption. Organizations should assume StealC remains an active threat and continue monitoring for both legacy and newly registered indicators.

How do initial access brokers use StealC logs?

Initial access brokers purchase bulk StealC logs from marketplaces such as Russian Market and 2Easy and sort them by value. High-value credentials, such as domain administrator accounts, RMM logins or cloud administrator tokens, are sold privately to ransomware affiliates. Lower-value StealC logs may be resold multiple times or used for credential stuffing. This ecosystem shortens the time between credential theft and network compromise, underscoring the need for continuous credential monitoring and dark-web surveillance.

How should we validate backups after a StealC infection?

Because StealC may deploy additional loaders or ransomware later, simply restoring from a backup can reintroduce the malware. Acronis' Safe Recovery process scans backup images during restoration to ensure no latent StealC loaders remain. Organizations should store backups immutably and verify that no unauthorized executables or scripts were present at the time of backup. After restoration, reset all credentials associated with the restored systems and monitor network traffic for anomalies.

Are there signs that a cloud account has been compromised by StealC logs?

If attackers use stolen StealC session tokens, they may authenticate from unusual geolocations or at odd times. Monitor access logs for IP addresses or regions that do not correlate with legitimate user activity. Unexpected modifications to cloud resources, such as new API keys, unexpected data downloads or disabling of multifactor authentication, may indicate session hijacking from StealC. Combine these observations with dark-web monitoring of stealer logs to identify if your domain appears in underground marketplaces.

StealC Malware: How It Works and How to Stop It

Key takeaways

StealC is a modular C++-based infostealer sold as MaaS; it evolved from a 32-bit DLL-dependent loader to a 64-bit RC4-encrypted JSON platform.
On June 24, 2026, Microsoft's Digital Crimes Unit, working with Europol, disrupted more than 200 StealC and Amadey command-and-control (C2) domains and IPs. The malware remains active on other infrastructure, so this is a disruption, not an end to the threat.
The broader infostealer ecosystem has stolen 1.8 billion credentials (Flashpoint, H1 2025), with logs sold for around $10 and premium corporate credentials fetching hundreds of dollars.
StealC logs serve as initial access currency for ransomware groups; Mandiant M-Trends 2026 documents the median time between initial access and handoff to a secondary threat group dropping to 22 seconds in 2025, meaning prevention matters far more than detection speed.
StealC distribution relies on social engineering (ClickFix / FileFix), the Amadey loader-as-a-service, supply-chain attacks (SmartLoader) and weaponized Blender files.
The StealC V2 attack chain includes sandbox checks, credential harvesting, RC4-encrypted JSON exfiltration and log resale.
Acronis counters StealC through behavioral detection, EDR / XDR telemetry, URL filtering, patch management, immutable backups, clean restore and managed detection and response.

What is StealC malware? Definition and overview

StealC is a C++-based infostealer sold as malware-as-a-service (MaaS). StealC first appeared on Russian-language forums in early 2023 and has evolved into a fully modular, 64-bit threat known as StealC V2, released in March 2025. The StealC operator ("Plymouth") shifted from a 32-bit loader with external DLL dependencies to a pure C++ architecture using a JSON-based C2 protocol encrypted with RC4. This modular design enables on-demand targeting of browser databases, system information and application tokens via real-time configuration flags.

By 2025, the broader infostealer ecosystem had stolen 1.8 billion credentials (Flashpoint, H1 2025), an 800% surge over the previous year. Logs harvested by StealC often sell for around $10 each on marketplaces such as Russian Market, while premium StealC logs containing VPN or RDP credentials can command $500 to $1,000.

According to the Verizon Data Breach Investigations Report 2025, credentials remain the leading initial-access vector (22% of breaches), with 88% of basic web application attacks involving stolen credentials, and more than 54% of ransomware victims had their domain credentials appear in stealer logs before encryption.

StealC V2 communicates using RC4-encrypted JSON over HTTP, allowing the operator to dynamically specify data types and exfiltration options. Logs produced by StealC feed directly into ransomware operations, including HellCat, Akira and RansomHub: Attackers "log in" instead of "break in."

Acronis regards StealC as a major risk in its own right, since an infostealer infection is effectively a breach: Harvested credentials give adversaries a ready-made identity, allowing them to render MFA ineffective by replaying stolen session tokens, hijacking active sessions and using legitimate tools to move laterally across connected applications and services. Acronis' behavioral detection and threat hunting capabilities are designed to disrupt this pipeline, identifying suspicious browser-spawned shellcode and flagging anomalous credential use before harvested logs reach the open market.

What law enforcement action has targeted StealC?

On June 24, 2026, Microsoft's Digital Crimes Unit, working with Europol and industry partners, announced a coordinated disruption action against StealC and Amadey, a malware-as-a-service loader that has been one of StealC's primary delivery mechanisms since at least 2018. DCU identified more than 200 malicious Amadey and StealC C2 domains and IPs and took them down through a combination of court orders, domain seizures, registrar actions and hosting-provider notifications.

This is a disruption of shared infrastructure, not a takedown of the StealC operation itself. The malware, its builder and its underground marketplace presence remain active on infrastructure outside the disrupted set, and operators of MaaS platforms have historically rebuilt within weeks of similar actions. Organizations should treat this as a temporary reduction in operating capacity rather than a resolved threat and continue monitoring for StealC and Amadey indicators.

How has StealC evolved? StealC V1 vs. StealC V2

Feature

StealC V1 (2023 to 2024)

StealC V2 (2025 to 2026)

Architecture

32-bit loader with external DLL dependencies

64-bit (x64) build compiled in C/C++; dynamic WinAPI resolution, no third-party DLLs

C2 communication

Individual HTTP POST requests with Base64-encoded payloads

JSON over HTTP; RC4 encryption in later variants (post-v2.1.1); dynamic access tokens and flags

Data extraction

Downloads third-party DLLs (for example, sqlite3.dll, nss3.dll) to decrypt browser data

Integrates password-recovery and file-grabber functions directly into the binary

Persistence

Non-resident; self-deletes after exfiltration

Optional self-delete flag and enhanced anti-analysis routines

Payload delivery

Executable or DLL dropper

Variety of loaders including EXE, MSI and PowerShell scripts

Target platforms

Windows only

Windows only (core binary)

Notable capabilities

Conducts environment checks (processor count, writable memory) to detect sandboxes

Supports multimonitor screenshot capture, hardware-ID-based file-grab rules and server-side brute forcing

What are the security implications of the StealC V2 upgrade?

The migration to encrypted JSON protocol and usage of fileless droppers make StealC V2 harder to detect. RC4 encryption conceals StealC command flags and exfiltration data, while integrated password-recovery modules reduce reliance on external DLLs. StealC V2 variants also apply granular rules based on hardware ID, geolocation and running processes to maximize data value.

How does StealC work? The StealC attack lifecycle

StealC follows a seven-stage attack lifecycle from delivery through ransomware affiliate handoff.

Delivery: Operators distribute StealC through malicious ads, social-engineering campaigns and loader services. ClickFix and FileFix convince users to paste commands into Win+R or File Explorer, initiating a multistage PowerShell chain. The Amadey loader-as-a-service delivers StealC as one of several payload options, including via a compromised self-hosted GitLab instance observed in December 2025. SmartLoader campaigns embed StealC inside trojanized Model Context Protocol servers, and some StealC V2 variants arrive via infected Blender files.
User execution: The delivered installer or script launches StealC by executing a PowerShell script, MSI package or trojanized executable.
Environment checks and sandbox evasion: Upon launch, StealC resolves Windows API functions dynamically and performs sandbox checks, such as counting CPUs via GetSystemInfo() and verifying writable memory via VirtualAllocExNuma(), to avoid analysis. StealC also checks the system locale and terminates if it matches Russian, Ukrainian, Belarusian, Kazakh or Uzbek. StealC V2 adds RC4-encrypted strings and VM detection routines.
Credential harvesting: Once past the checks, StealC harvests credentials and session tokens from browser databases (SQLite/NSS), cookies, cryptocurrency wallets and VPN or cloud configuration files. StealC can brute-force passwords and capture multimonitor screenshots.
JSON-based RC4 C2 exfiltration: StealC packages stolen data into small JSON messages and exfiltrates them via RC4-encrypted HTTP posts. Unique access tokens and flags instruct the StealC bot on what to steal next.
Log packaging and marketplace resale: Harvested data are compressed into “logs” and uploaded to underground markets such as Russian Market, 2Easy and Genesis. Average StealC logs sell for about $10, while premium corporate credentials fetch higher prices.
Ransomware affiliate access sale: Initial access brokers purchase StealC logs and resell high-value credentials to ransomware groups. The median time between initial access and handoff to a secondary threat group dropped to 22 seconds in 2025 (Mandiant M-Trends 2026), leaving defenders almost no window to intervene once handoff begins.

What are the confirmed StealC delivery methods? (2023 to 2026)

ClickFix: Presents a fake browser error or CAPTCHA and instructs the user to paste a command into the Win+R dialog. The command executes a multistage PowerShell script that downloads and runs StealC.
FileFix: First observed by Acronis in July 2025, it uses the Windows File Explorer address bar. Victims paste a command that triggers a Go loader decoding StealC payloads hidden in AI-generated JPEGs via steganography.
Amadey loader-as-a-service: Active since at least 2018, Amadey is a MaaS loader that delivers StealC alongside Lumma, remote access trojans, cryptominers and, in some cases, ransomware. In December 2025, Trellix documented Amadey retrieving StealC from a compromised self-hosted GitLab instance rather than public hosting, using a long-established domain with valid TLS certificates to blend in with legitimate traffic.
SmartLoader (MCP server poisoning): Threat actors trojanized an Oura Health Model Context Protocol server and distributed it through cloned GitHub repositories. Developers installed the malicious server, unknowingly deploying StealC.
Blender 3D model weaponization: Attackers uploaded .blend files containing auto-run Python scripts to asset-sharing sites such as CGTrader. Opening the file executed a loader that deployed StealC V2.
Malvertising and fake software: Cracked or pirated software promoted through YouTube ghost accounts and SEO-poisoned search results continues to deliver StealC alongside other infostealer families.

Why are MSPs at elevated risk from StealC?

Managed service providers (MSPs) manage multiple client networks and hold powerful remote monitoring and management (RMM) credentials. StealC logs containing RMM login details can give attackers immediate access to many client environments. Multitenant architectures amplify this risk: A single compromised administrative account may expose dozens of downstream organizations. Backup administrators are also high-value targets: If an attacker obtains backup console credentials via StealC, they can delete or encrypt backups before deploying ransomware. Supply-chain attacks such as the SmartLoader campaign show how malicious software updates can introduce StealC into MSP tooling. See the Third-Party Compromise catalog entry for additional context.

How does Acronis protect against StealC?

Acronis mitigates StealC across prevention, detection, response and recovery layers. The table below maps each stage of the StealC attack lifecycle to the risk, the capability required to address it and the corresponding Acronis response.

Attack stage

Risk

Required capability

Acronis capability

Outcome

Delivery

ClickFix and FileFix lures, the Amadey loader-as-a-service, SmartLoader supply-chain poisoning and weaponized Blender files all deliver StealC through different vectors.

Web-layer blocking of malicious domains and automated vulnerability remediation.

URL filtering and automated patch management (Advanced Management add-on)

Blocks known malicious domains and closes exploitable vulnerabilities across multiple delivery vectors, not just one lure type.

Execution and evasion

Sandbox checks, dynamic API resolution and fileless execution via PowerShell or MSI avoid dropping files on disk.

Behavioral detection of fileless and in-memory execution.

Active Protection (behavioral engine)

Detects browser-spawned shellcode and anomalous PowerShell or MSI execution in real time, including variants that evade signature-based detection.

Credential harvesting and C2 exfiltration

RC4-encrypted JSON exfiltration of browser credentials, cookies, wallets and cloud tokens to StealC C2 infrastructure.

Endpoint telemetry, deep process monitoring and proactive threat hunting.

Acronis EDR / XDR with threat hunting

Alerts when processes access cookie stores, password databases or cloud credential files, and supports proactive hunting for StealC indicators across managed endpoints.

Monetization and ransomware handoff

Logs are sold to initial access brokers and ransomware affiliates within a median of 22 seconds of the secondary-group handoff, leaving almost no window for manual response.

24/7 monitored detection and response that does not depend on human reaction time alone.

Acronis MDR

Provides continuous SOC monitoring and automated initial response so that account suspension and containment can begin before an analyst would otherwise be paged.

Impact and recovery

Ransomware or data-theft follow-on damage; a naive restore can reintroduce a latent StealC loader.

Tamper-resistant backup and malware-free restoration.

Immutable backup and Safe Recovery

Prevents backups from being deleted or corrupted even with stolen admin credentials, and scans backup images for latent StealC loaders before restoration. Immutable backup does not neutralize credentials or data already exfiltrated before the incident was detected.

Frequently asked questions about StealC

Can StealC infections be prevented, and does early detection still matter?
Prevention should be the primary focus. Mandiant M-Trends 2026 documents a median of 22 seconds between initial access and handoff to a secondary threat group in 2025, which leaves defenders almost no realistic window to detect and respond once that handoff begins. This makes blocking the delivery vector, ClickFix and FileFix lures, malicious Amadey payloads, poisoned loaders, and unpatched exposure, far more effective than relying on detection alone.
Detection still has value as a second layer and for identifying infections that predate the handoff. Look for unexpected network requests to unfamiliar domains and repeated HTTP POSTs containing small, RC4- or Base64-encoded JSON chunks. On endpoints, monitor for PowerShell or Go scripts launched from the Win+R dialog or the File Explorer address bar. Behavioral anomalies such as multimonitor screenshot capture and access to browser cookie databases are also StealC indicators, but should be treated as confirmation of a problem that prevention already should have stopped.
What registry or file artifacts does StealC leave behind?
Do I need to reset passwords and session cookies after a StealC incident?
Yes. StealC harvests saved passwords and session cookies from more than 23 browsers and can steal authentication tokens that bypass multifactor authentication. After eradicating StealC, you must invalidate all session tokens and reset passwords for services accessed from the infected machine. Rotate API keys, cloud access tokens and SSH keys, and enable device-based verification where possible to prevent reused sessions from being exploited.
Can StealC steal cryptocurrency or browser-stored wallets?
Yes. StealC's file-grabber and credential-harvesting modules target browser databases and credential files, including browser-based cryptocurrency wallets and keystore files. Attackers value cryptowallets because they provide direct, irreversible monetary gain. Organizations and individuals using browser wallets should export private keys to hardware wallets and remove them from browsers where possible.
Is StealC still active after the June 2026 disruption, and how frequently is it updated?
Yes. Microsoft's June 24, 2026 disruption action, conducted with Europol, took down more than 200 StealC and Amadey C2 domains and IPs, but it targeted shared infrastructure rather than the StealC operation itself. The developer, known as “Plymouth,” has historically maintained a fast release cadence with regular changelogs and feature updates, and MaaS operators typically rebuild infrastructure within weeks of a disruption. Organizations should assume StealC remains an active threat and continue monitoring for both legacy and newly registered indicators.
How do initial access brokers use StealC logs?
Initial access brokers purchase bulk StealC logs from marketplaces such as Russian Market and 2Easy and sort them by value. High-value credentials, such as domain administrator accounts, RMM logins or cloud administrator tokens, are sold privately to ransomware affiliates. Lower-value StealC logs may be resold multiple times or used for credential stuffing. This ecosystem shortens the time between credential theft and network compromise, underscoring the need for continuous credential monitoring and dark-web surveillance.
How should we validate backups after a StealC infection?
Because StealC may deploy additional loaders or ransomware later, simply restoring from a backup can reintroduce the malware. Acronis' Safe Recovery process scans backup images during restoration to ensure no latent StealC loaders remain. Organizations should store backups immutably and verify that no unauthorized executables or scripts were present at the time of backup. After restoration, reset all credentials associated with the restored systems and monitor network traffic for anomalies.
Are there signs that a cloud account has been compromised by StealC logs?
If attackers use stolen StealC session tokens, they may authenticate from unusual geolocations or at odd times. Monitor access logs for IP addresses or regions that do not correlate with legitimate user activity. Unexpected modifications to cloud resources, such as new API keys, unexpected data downloads or disabling of multifactor authentication, may indicate session hijacking from StealC. Combine these observations with dark-web monitoring of stealer logs to identify if your domain appears in underground marketplaces.