Threat reportMalwareTL-2026-4271
Stadia RAT: StealC Rebrand Combines Credential Theft with HVNC Remote Control of Windows PCs
Stadia RAT: StealC Rebrand Combines Credential Theft with (TL-2026-4271), also tracked as Stadia, is a high-severity malware campaign, first published 2026-10-23. It has no confirmed attribution, affects Microsoft Windows, maps to 16 MITRE ATT&CK techniques (T1005, T1021.005, T1036.005), and is covered by 9 detection rules and 21 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 21Indicators of compromise
Key facts for TL-2026-4271
- Threat ID
- TL-2026-4271
- Also known as
- Stadia, Stadia RAT, StealC successor
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, cryptocurrency, gaming, consumer
- Target regions
- Asia, Africa, Latin America, Global
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in Stadia RAT: StealC Rebrand Combines Credential Theft with
Malware and tooling: Stadia, Stealc
How Stadia RAT: StealC Rebrand Combines Credential Theft with works
Stadia is a Windows remote access trojan sold by subscription by the actor 'plymouth', the seller behind the StealC infostealer, following the June 2026 Operation Endgame disruption. It bundles six modules (stealer, HVNC hidden desktop, remote command shell, loader, file explorer, process manager) and reuses StealC 3.5 code byte for byte.
Stadia was first listed in a beta (v1.0.0) on 10 September 2026, updated its stealer module to StealC 3.5.0 on 29 September 2026, and was publicly advertised on 16 October 2026 as agent/panel version 1.1.2. Varonis Threat Labs obtained the build shortly after listing, reversed it and operated the panel against a lab host. They identified a 26,112-byte Chromium App-Bound Encryption helper embedded in Stadia that is byte-for-byte identical to the one in StealC 3.5 builds, and the seller handle 'plymouth' is the same persona that sold StealC. The seller offers former StealC customers a free month of the top tier.
The analyzed sample (stadia_x32.exe, 560,128 bytes) is an unsigned, unpacked 32-bit MSVC native PE that resolves most APIs from KERNEL32.dll, decrypts strings with RC4 plus Base64, and carries the build marker STADIA_BETA. At startup it exits silently when the system language is Russian, Ukrainian, Belarusian, Kazakh or Uzbek, and it enforces a single instance with the mutex Local\<username>.<computername>. It installs itself to a random 12-character directory under C:\ProgramData\ using a name that imitates a legitimate updater or system binary (RuntimeBroker.exe, SecurityHealthHost.exe, SearchHost.exe, TextInputHost.exe, MicrosoftEdgeUpdate.exe, GoogleUpdate.exe, OneDriveStandaloneUpdater.exe, nvcontainer.exe, AdobeARM.exe). Persistence is a hidden scheduled task registered through the Task Scheduler COM API (not schtasks.exe), triggered at logon and repeating every 15 minutes with a roughly 10-year (3,650-day) duration under an InteractiveToken principal. When elevated it runs PowerShell Add-MpPreference -ExclusionPath to exclude its ProgramData directory from Microsoft Defender.
The six modules are: HVNC (current-desktop or isolated hidden-desktop sessions, named desktop object StadiaVnc%d, JPEG frame streaming, injected keyboard/mouse input); Stealer (more than 50 browsers, 120+ cryptocurrency extensions, 50+ desktop wallets, plus messaging, gaming, email and VPN clients, and Steam, Discord, Azure and Roblox sessions); Remote CMD (hidden shell with bidirectional stdin/stdout); File Explorer (browse, upload, download, chunked transfer); Process Manager (tree view, CPU/RAM, termination); and Loader (EXE, PowerShell, BAT/CMD and MSI payloads from disk or memory, with hidden or runas modes). For browser credential theft it starts a genuine Chrome, Edge or Brave process suspended and writes a ~26 KB code block into it; a transient GUID-named .txt file in C:\ProgramData\ holds a 64-character hex key before deletion.
C2 is plain HTTP POST to the root path of three hard-coded IPs (93.152.213.215, 91.92.43.45, 193.148.56.97), tried in sequence with an 8-second timeout and a 300-second retry interval. Bodies are Base64(RC4(JSON)) with key eepkTOgSwdNCgrhITR, while the Content-Type header claims application/json, a detectable mismatch. The first message is set_online with a 72-zero host_token. The operator panel is associated with stadiadev.cc. Subscription tiers are Basic $300/month (loader, stealer; 1 build), Team $550/month (up to 5 builds) and Pro $900/month (all six modules, unlimited builds). The panel demo showed 596 hosts with infections concentrated in South/Southeast Asia, Africa and Latin America. Note: sources are secondary reporting of the Varonis research; one outlet misdated Operation Endgame as June 2024, while the other sources and the hunt record place the StealC disruption in June 2026 (326 servers and 142 domains seized, per the reporting). BeaconBeagle returned no record (HTTP 404) for any of the three C2 IPs at research time.
MITRE ATT&CK techniques used in TL-2026-4271
Collection
T1005 Data from Local System; T1113 Screen Capture
Lateral Movement
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection
Persistence
Discovery
T1057 Process Discovery; T1614.001 System Language Discovery
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell
Command and Control
T1071.001 Web Protocols; T1132.001 Standard Encoding; T1573.001 Symmetric Cryptography
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
defense-impairment
Affected products and versions in Stadia RAT: StealC Rebrand Combines Credential Theft with
- Microsoft — Windows
Vulnerable versions: Windows endpoints (32-bit PE agent) - Google / Microsoft / Brave — Chrome, Edge and Brave browsers (credential and session theft)
Vulnerable versions: Chromium-based browsers incl. App-Bound Encryption bypass
Remediation for Stadia RAT: StealC Rebrand Combines Credential Theft with
Immediate actions
- Block egress to 93.152.213.215, 91.92.43.45 and 193.148.56.97 and DNS/web access to stadiadev.cc
- Hunt for unsigned executables in C:\ProgramData\<12-character random>\ named like RuntimeBroker.exe, SearchHost.exe or MicrosoftEdgeUpdate.exe
- Hunt for hidden scheduled tasks with a PT15M repetition and P3650D duration
- Alert on PowerShell Add-MpPreference -ExclusionPath pointing into C:\ProgramData
- On confirmed infection, isolate the host and reset browser-stored credentials, revoke session cookies/tokens and move cryptocurrency wallet funds
Workarounds
- Do not store credentials or crypto wallet material in browsers on shared or unmanaged endpoints
Longer-term hardening
- Alert on HTTP POST to bare IPs where Content-Type is application/json but the body is Base64 ciphertext
- Alert on unsigned processes spawning chrome.exe, msedge.exe or brave.exe in a suspended state
- Restrict who can modify Microsoft Defender exclusions and enable tamper protection
- Enforce application allow-listing for user-writable paths such as C:\ProgramData
Timeline of Stadia RAT: StealC Rebrand Combines Credential Theft with
- StealC infostealer begins to be sold as malware-as-a-service by the developer 'plymouth' on Russian-language underground forums
- Operation Endgame disrupts StealC infrastructure (June 2026; exact day not stated in sources): 326 servers and 142 domains actioned
- Stadia v1.0.0 beta launched
- Stadia stealer module updated to StealC 3.5.0
- Stadia publicly advertised by plymouth with a free Pro-tier month offered to former StealC customers
- Varonis Threat Labs analysis of Stadia v1.1.2 reported, showing a byte-for-byte match of the 26,112-byte Chromium App-Bound Encryption helper with StealC 3.5
- Wider media coverage and IOC dissemination (Cyber Security News, GBHackers, Cyberpress)
Sources cited for Stadia RAT: StealC Rebrand Combines Credential Theft with
- StealC Malware Returns as New Stadia RAT to Steal Passwords and Secretly Control Windows PCs
- StealC Is Back, and This Time It's a RAT
- StealC Infostealer Returns as Powerful Remote Access Trojan After Europol Takedown
- Cybercriminals Bring Back StealC as Stadia RAT to Steal Passwords and Cryptocurrency Wallets
- StealC is back with a RAT
- StealC Malware Returns as New Stadia RAT (Cryptika)
- StealC Is Back, and This Time It's a RAT (OffSeq Radar)
Detection coverage for TL-2026-4271
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4271 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.