The criminal who sold the StealC infostealer is back four months after Operation Endgame, this time selling a full remote access trojan called Stadia. Varonis says the new malware reuses StealC code byte for byte and is pitched at crews that want to stay in a network after the theft, not just grab credentials.
What happened
On 16 October 2026 a new listing appeared on a criminal forum advertising Stadia, a Windows implant offering credential theft, a loader, remote shell access, file browsing, process control and hidden remote desktop. Varonis researchers obtained a build soon after launch, reverse engineered it and ran it against a test host of its own. Its write-up, published this week, ties Stadia directly to the seller behind StealC, one of the most widely rented infostealers of recent years.
StealC was among the services hit in June by Operation Endgame, the Europol-coordinated action against the malware supply chain. According to Varonis, the June phase seized 326 servers and 142 domains. CyberPress notes those totals covered the combined action, which also targeted SocGholish and Amadey, not StealC alone. Four months on, the seller has rebuilt under a new brand and is offering every former StealC customer a free month on its top tier to bring them back.
Stadia is sold on subscription. The Basic plan costs $300 a month, a Team plan $550, and the $900 Pro tier is the only one that unlocks all six modules. The panel’s changelog shows a first beta on 10 September, so the comeback was weeks in the making.
The technical picture
The proof of lineage is concrete. Inside the Stadia agent Varonis found a 26,112-byte helper used to defeat Chromium’s App-Bound Encryption, the protection Google added to stop other processes reading saved cookies and passwords. That exact blob appears in the StealC 3.5 builds the researchers hold, matching to the byte, so the seller’s claim of StealC heritage is confirmed.
The sample is an unsigned, unpacked 32-bit Visual C++ executable of about 560KB that resolves Windows functions at runtime and hides its strings and configuration with RC4 and Base64. Like much Russian-speaking crimeware, it quits if the system language is Russian, Ukrainian, Belarusian, Kazakh or Uzbek.
Once running, it copies itself into a randomly named folder under C:\ProgramData, using a filename borrowed from legitimate software such as an Edge, Google or OneDrive updater. Persistence comes from a hidden scheduled task that fires at logon and then every 15 minutes. Varonis points out that the task is created through the COM interface, so detection rules that only look for schtasks.exe will not see it. With administrative rights, the agent also tells Microsoft Defender to ignore its install folder.
Command and control is plain HTTP to three hard-coded IP addresses, tried in turn. The requests claim to carry JSON but the body is encrypted and encoded, a mismatch that network monitoring can pick up. To steal from browsers, it launches a real copy of Chrome, Edge or Brave, holds it frozen, injects roughly 26KB of code and briefly parks the recovered browser key in a temporary file.
The advertised targets span more than 50 browsers, over 120 crypto wallet extensions, messaging apps, email clients and VPN software, and the panel files stolen session tokens by service, Azure among them. Varonis does not say how Stadia is delivered, and there is no verified infection count.
Why it matters for UK organisations
Infostealer logs feed the initial access market that sits behind so much ransomware and extortion. Session cookies and saved passwords taken from one employee’s browser, including from a personal device used for work, are routinely sold on and used to log in to cloud services without triggering a password prompt or an MFA challenge.
What changes with Stadia is what the buyer gets. A stealer runs, collects and usually leaves. A RAT stays. Hidden desktop control lets an operator drive the victim’s own browser from the victim’s own machine and IP address, where conditional access and impossible-travel checks see nothing odd, while the loader turns one infection into a platform for whatever comes next. For a UK firm, an infected laptop now looks less like a credential leak to clean up and more like an intrusion that needs a full response.
There is also a lesson about takedowns. Endgame did real damage: the infrastructure went and millions of stolen credentials were recovered. But the code survived, and so did the customer base. Varonis’s observation that a seller with existing buyers could relaunch in four months should temper any assumption that a headline law enforcement action has removed a threat from the landscape.
Expert view
In my experience, the endpoint findings that cause the most damage on a test are rarely exotic. They are the quiet ones: a scheduled task nobody owns, a Defender exclusion someone added years ago, an unsigned binary living in ProgramData with a convincing name. Stadia leans on exactly that kind of noise. None of its persistence techniques is new, and that is the point. Commodity malware does not need novelty when so many estates still tolerate untidy endpoints.
The rebranding is equally familiar. Criminal software firms version, ship changelogs and offer loyalty deals like any vendor, so defenders who track malware purely by family name will lag. Varonis rightly argues that build-specific indicators change every time and behaviour is the durable signal. When we run purple team exercises, the detections that survive a change of tooling are the behavioural ones, every time.
The detail I would stress to UK boards is the move from theft to residency. If your incident playbook for an infostealer infection is “reset the user’s password”, it is stale.
What to do now
- Hunt for the behaviours, not just the hashes. Look for unsigned executables in randomly named ProgramData folders, hidden scheduled tasks repeating every 15 minutes, and Defender exclusion changes made through PowerShell. Make sure task-creation monitoring covers COM registration, not only schtasks.exe.
- Alert on browser process injection. Unsigned software spawning a frozen browser and writing code into it is a strong signal. Tune in alert mode first, as Varonis advises.
- Lock down Defender exclusions. Enable tamper protection and restrict who can add exclusions. This sits under the Cyber Essentials malware protection control.
- Remove local admin rights. Stadia’s Defender exclusion step needs elevation. Least privilege is a core Cyber Essentials user access control requirement and limits the damage.
- Treat an infostealer or RAT hit as a session compromise. Revoke refresh tokens and active sessions for every affected identity, rotate saved credentials, check for new MFA methods or mailbox rules, and rebuild the device.
- Reduce browser credential storage. Use an enterprise password manager and shorten session lifetimes for high-value cloud apps.
- Watch egress. Plain HTTP POSTs to bare IP addresses with a JSON content type but non-JSON bodies are worth flagging at the proxy or firewall.
Bottom line
Operation Endgame took StealC’s servers, not its author or its code. Stadia is the same operation back with a bigger toolkit, built to keep hands on keyboards inside victim machines. UK defenders should hunt for its behaviours, harden endpoints against its persistence tricks, and stop treating infostealer infections as a simple password reset.
