# Stadia RAT: StealC Rebrand Combines Credential Theft with HVNC Remote Control of Windows PCs

> Stadia is a Windows remote access trojan sold by subscription by the actor 'plymouth', the seller behind the StealC infostealer, following the June 2026 Operation Endgame disruption. It bundles six modules (stealer, HVNC hidden desktop, remote command shell, loader, file explorer, process manager) and reuses StealC 3.5 code byte for byte.

- **Published:** 2026-10-23T14:07:35Z
- **Last reviewed:** 2026-10-23T14:07:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4271
- **ID:** TL-2026-4271
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Stadia was first listed in a beta (v1.0.0) on 10 September 2026, updated its stealer module to StealC 3.5.0 on 29 September 2026, and was publicly advertised on 16 October 2026 as agent/panel version 1.1.2. Varonis Threat Labs obtained the build shortly after listing, reversed it and operated the panel against a lab host. They identified a 26,112-byte Chromium App-Bound Encryption helper embedded in Stadia that is byte-for-byte identical to the one in StealC 3.5 builds, and the seller handle 'plymouth' is the same persona that sold StealC. The seller offers former StealC customers a free month of the top tier.

The analyzed sample (stadia_x32.exe, 560,128 bytes) is an unsigned, unpacked 32-bit MSVC native PE that resolves most APIs from KERNEL32.dll, decrypts strings with RC4 plus Base64, and carries the build marker STADIA_BETA. At startup it exits silently when the system language is Russian, Ukrainian, Belarusian, Kazakh or Uzbek, and it enforces a single instance with the mutex Local\<username>.<computername>. It installs itself to a random 12-character directory under C:\ProgramData\ using a name that imitates a legitimate updater or system binary (RuntimeBroker.exe, SecurityHealthHost.exe, SearchHost.exe, TextInputHost.exe, MicrosoftEdgeUpdate.exe, GoogleUpdate.exe, OneDriveStandaloneUpdater.exe, nvcontainer.exe, AdobeARM.exe). Persistence is a hidden scheduled task registered through the Task Scheduler COM API (not schtasks.exe), triggered at logon and repeating every 15 minutes with a roughly 10-year (3,650-day) duration under an InteractiveToken principal. When elevated it runs PowerShell Add-MpPreference -ExclusionPath to exclude its ProgramData directory from Microsoft Defender.

The six modules are: HVNC (current-desktop or isolated hidden-desktop sessions, named desktop object StadiaVnc%d, JPEG frame streaming, injected keyboard/mouse input); Stealer (more than 50 browsers, 120+ cryptocurrency extensions, 50+ desktop wallets, plus messaging, gaming, email and VPN clients, and Steam, Discord, Azure and Roblox sessions); Remote CMD (hidden shell with bidirectional stdin/stdout); File Explorer (browse, upload, download, chunked transfer); Process Manager (tree view, CPU/RAM, termination); and Loader (EXE, PowerShell, BAT/CMD and MSI payloads from disk or memory, with hidden or runas modes). For browser credential theft it starts a genuine Chrome, Edge or Brave process suspended and writes a ~26 KB code block into it; a transient GUID-named .txt file in C:\ProgramData\ holds a 64-character hex key before deletion.

C2 is plain HTTP POST to the root path of three hard-coded IPs (93.152.213.215, 91.92.43.45, 193.148.56.97), tried in sequence with an 8-second timeout and a 300-second retry interval. Bodies are Base64(RC4(JSON)) with key eepkTOgSwdNCgrhITR, while the Content-Type header claims application/json, a detectable mismatch. The first message is set_online with a 72-zero host_token. The operator panel is associated with stadiadev.cc. Subscription tiers are Basic $300/month (loader, stealer; 1 build), Team $550/month (up to 5 builds) and Pro $900/month (all six modules, unlimited builds). The panel demo showed 596 hosts with infections concentrated in South/Southeast Asia, Africa and Latin America. Note: sources are secondary reporting of the Varonis research; one outlet misdated Operation Endgame as June 2024, while the other sources and the hunt record place the StealC disruption in June 2026 (326 servers and 142 domains seized, per the reporting). BeaconBeagle returned no record (HTTP 404) for any of the three C2 IPs at research time.

## MITRE ATT&CK

- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1614.001 System Language Discovery
- T1057 Process Discovery
- T1021.005 VNC
- T1005 Data from Local System
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1573.001 Symmetric Cryptography

## Sources

- [StealC Malware Returns as New Stadia RAT to Steal Passwords and Secretly Control Windows PCs](https://cybersecuritynews.com/stealc-malware/)
- [StealC Is Back, and This Time It's a RAT](https://hackernoon.com/stealc-is-back-and-this-time-its-a-rat)
- [StealC Infostealer Returns as Powerful Remote Access Trojan After Europol Takedown](https://gbhackers.com/stealc-malware-resurfaces/)
- [Cybercriminals Bring Back StealC as Stadia RAT to Steal Passwords and Cryptocurrency Wallets](https://cyberpress.org/stealc-returns-as-stadia/)
- [StealC is back with a RAT](https://itnerd.blog/2026/10/22/stealc-is-back-with-a-rat/)
- [StealC Malware Returns as New Stadia RAT (Cryptika)](https://www.cryptika.com/stealc-malware-returns-as-new-stadia-rat-to-steal-passwords-and-secretly-control-windows-pcs/)
- [StealC Is Back, and This Time It's a RAT (OffSeq Radar)](https://radar.offseq.com/threat/stealc-is-back-and-this-time-its-a-rat-a419409e59d93901)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4271