StealC Returns as Stadia RAT to Steal Passwords and Remotely Control Windows PCs

The operator behind the StealC service has resurfaced with a new Windows remote-access trojan named Stadia, which pairs credential theft with covert desktop control.

First advertised on October 16, 2026, Stadia expands beyond data exfiltration to let attackers execute commands, browse files, manage processes, and deploy additional malware.

This emergence follows the disruption of the earlier StealC infrastructure during June’s Operation Endgame, when authorities seized 326 servers and 142 domains, according to Varonis.

Although the June takedown interrupted the criminal offering, leftover StealC code provided the seller with material to rebuild under the Stadia name.

Researchers at Varonis Threat Labs linked Stadia to StealC after obtaining a build, analyzing its code, and testing the web control panel against a Windows host they controlled.

Their technical review revealed an embedded browser-encryption helper that is identical, byte for byte, to the one in StealC 3.5—direct evidence of code reuse.

StealC malware returns as new Stadia RAT

Stadia is modular and includes six components: a stealer, hidden desktop access, a remote command shell, a loader, a file explorer, and a process manager.

The hidden virtual network computing (HVNC) module gives an operator control of a separate desktop session the victim cannot see. File tools support uploads, downloads, and remote execution.

The seller advertises collection from over 50 browsers, 120 cryptocurrency extensions, and 50 desktop wallets. Other targets include messaging apps, gaming sessions, email clients, and VPN software.

Combining stolen browser data with remote access resembles tactics seen in Dolphin X credential-theft operations, where the risk extends well beyond individual account compromise.

Subscription pricing is quoted at $300 per month for Basic, $550 for Team, and $900 for Pro. Only the Pro tier includes all six modules. The seller offers former StealC customers a free Pro month, helping attract buyers whose prior infrastructure was taken down. The tested panel and agent reported version 1.1.2.

How Stadia hides and communicates

The analyzed sample is an unsigned, 560,128-byte, 32-bit Windows executable compiled with Microsoft Visual C++. It conceals important strings using RC4 encryption and Base64 encoding and resolves most Windows API functions at runtime.

Stadia checks system locale and exits if certain Russian, Ukrainian, Belarusian, Kazakh, or Uzbek language settings are present. On installation it creates a randomly named folder under Windows’ shared application-data directory and uses a filename designed to resemble legitimate software.

Persistence is achieved via a hidden scheduled task that runs at logon and every 15 minutes. If the malware obtains elevated permissions, it also adds its install folder to Microsoft Defender exclusions using PowerShell.

To extract browser data, an unsigned process launches Chrome, Edge, or Brave in a suspended state and injects about 26 KB of code. The recovered browser encryption key is briefly written to a temporary text file before being removed.

Related ChonkyChicken browser credential attacks underline why protected browser storage remains an important monitoring focus. Stadia communicates with three hard-coded servers over HTTP.

Although its requests claim to contain JSON, they actually carry RC4-encrypted then Base64-encoded payloads. Defenders should investigate this inconsistency alongside signs such as suspicious browser injection, hidden scheduled tasks, and new antivirus exclusions.

Varonis cautions that server addresses and encryption keys vary between builds, so behavior-based detection is likely more resilient than static blocking. The report does not specify an initial distribution method or provide an independently verified infection count.

Indicators of compromise (IoCs)

Note: IP addresses and domains above are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate threat-intelligence feeds with data from 16K SOCs.