# StealC Infostealer and Amadey Loader Malware-as-a-Service Cybercrime Ecosystem (Operation Endgame Disruption)

> StealC is a malware-as-a-service (MaaS) infostealer that harvests browser credentials, cookies, cryptocurrency wallets, email/FTP clients and gaming data, while Amadey is a modular MaaS loader that fingerprints victims and deploys StealC and other payloads. On June 24, 2026, Microsoft's Digital Crimes Unit, Europol and industry partners executed Operation Endgame, taking down 326 servers, 142 domains and 200+ C2 endpoints tied to roughly 140,000 infections and ~27 million stolen credentials.

- **Published:** 2026-06-25T00:00:00Z
- **Last reviewed:** 2026-06-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0941
- **ID:** TL-2026-0941
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** StealC
- **Detections:** 9 · **IOCs:** 42 (full data via the Threadlinqs MCP server — Purple tier)

## Description

StealC and Amadey form a tightly coupled commodity-malware ecosystem that powers the modern infostealer-to-ransomware supply chain. Amadey (active since at least 2018, a modular C++ HTTP backdoor sold as a service) acts as the initial loader: it copies itself to a randomly named directory (e.g. nudwee.exe under a numeric folder such as C:\Users\<user>\e079729711), establishes scheduled-task persistence, fingerprints the host (bot ID, version, OS, bitness, admin rights, antivirus, domain) over an RC4-encrypted HTTP POST, and then services a numeric backdoor command set (0x0A-0x1D) to drop EXE/DLL/MSI/PowerShell payloads, run cmd, inject code, start/stop a SOCKS proxy, load credential (cred.dll) and clipboard (clip.dll) plugins, capture screenshots, enable RDP (fDenyTSConnections=0), and create hidden local admin accounts.

StealC is the data-theft endpoint of the chain. After fingerprinting, it registers with its C2 via an RC4-encrypted, Base64-encoded 'create' POST containing the hardware ID and build ID, then receives a JSON configuration (access token, browser-stealing targets, file-grab rules, feature flags). It steals Chromium-family browser data (Chrome, Edge, Brave, Opera, Vivaldi) by injecting a ~165KB payload into a sacrificial CREATE_SUSPENDED process via VirtualAllocEx/WriteProcessMemory/QueueUserAPC to defeat App-Bound Encryption, decrypting output to C:\ProgramData\<HWID>.txt; it also parses Firefox/Gecko profiles, Outlook and Foxmail mail credentials, WinSCP saved sessions, Steam session files, and grabs files per C2 rules. It captures a 90%-quality JPEG desktop screenshot, fetches and runs follow-on payloads (EXE / 'iwr <URL>|iex' PowerShell cradle / msiexec MSI), then self-deletes.

Both families implement CIS-locale guardrails, terminating on Russian, Ukrainian, Belarusian, Kazakh or Uzbek systems, and check Russian/Ukrainian/Belarusian keyboard layouts. Distribution is via SEO poisoning and malvertising pushing trojanized popular software, the ClickFix social-engineering technique (tricking users into pasting a PowerShell cradle into the Run dialog), and targeted phishing. Stolen logs reach dark-web markets within hours ($2-$50 per log, $100+ for bank/corporate logs), feeding initial access brokers and ransomware operators, with enterprise breaches following in 48-72 hours to months. The June 24, 2026 Operation Endgame action (Microsoft DCU, Europol EC3/J-CAT, Eurojust, Germany's BKA, and partners BitSight, ESET, IBM X-Force, Lumen, Mitsui Bussan Secure Directions and Proofpoint) seized 326 servers and 142 domains, disrupted 200+ C2 endpoints, tracked ~27 million stolen credentials, and froze over €41 million (~$47M) in crypto assets.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1588.001 Malware
- T1566 Phishing
- T1189 Drive-by Compromise
- T1195.002 Compromise Software Supply Chain
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1204.002 Malicious File
- T1106 Native API
- T1569.002 Service Execution
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1136.001 Local Account
- T1055.004 Asynchronous Procedure Call
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1070.004 File Deletion
- T1497.001 System Checks
- T1685 Disable or Modify Tools
- T1555.003 Credentials from Web Browsers
- T1555 Credentials from Password Stores
- T1056.004 Credential API Hooking
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1016 System Network Configuration Discovery
- T1518 Software Discovery
- T1057 Process Discovery
- T1614.001 System Language Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1008 Fallback Channels
- T1090 Proxy
- T1573.001 Symmetric Cryptography
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel

## Sources

- [StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them](https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/)
- [Europol-Led Operation Endgame Takes Down StealC and Amadey Infostealers](https://www.infosecurity-magazine.com/news/operation-endgame-stealc-amadey/)
- [Law enforcement hits StealC and Amadey malware networks (Operation Endgame)](https://www.helpnetsecurity.com/2026/06/24/operation-endgame-stealc-amadey-malware-disrupted/)
- [ESET takes part in global Operation Endgame to disrupt Amadey botnet and Stealc infostealer](https://www.globenewswire.com/news-release/2026/06/24/3316918/0/en/eset-takes-part-in-global-operation-endgame-to-disrupt-amadey-botnet-and-stealc-infostealer.html)
- [Bitsight Aids Disruption Efforts on Amadey & StealC Malware](https://www.bitsight.com/blog/bitsight-aids-disruption-efforts-on-amadey-malware-and-stealc-malware)
- [Europol Disrupts StealC and Amadey Malware Infrastructure in Operation Endgame](https://securityaffairs.com/194173/cyber-crime/europol-disrupts-stealc-and-amadey-malware-infrastructure-in-operation-endgame.html)
- [Operation Endgame Disrupts StealC, Amadey and SocGholish Malware Networks](https://hackread.com/operation-endgame-stealc-amadey-socgholish-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0941