Published on October 23, 2026
StealC Malware Returns as New Stadia RAT to Steal Passwords and Secretly Control Windows PCs
Severity
Medium
Detail
Varonis Threat Labs researchers have published an analysis detailing Stadia, a new Windows Remote Access Trojan (RAT) created by the developer behind the StealC information stealer. Advertised on dark web forums on October 16, 2026—following the disruption of StealC during June’s Operation Endgame takedown—Stadia marks an evolution from simple data theft into full interactive system control.
Sold as a subscription-based service ($300 to $900 per month), Stadia combines browser data exfiltration with Hidden Virtual Network Computing (HVNC), a remote command shell, process management, and payload delivery capabilities. Technical analysis confirms direct code reuse, including an embedded browser encryption helper identical byte-for-byte to StealC version 3.5.
How?
Stadia is deployed as an unsigned 32-bit Windows C++ executable that conceals its internal logic using RC4 encryption, Base64 encoding, and dynamic API resolving. Upon execution, it checks system language settings—exiting immediately if Russian, Ukrainian, Belarusian, Kazakh, or Uzbek locales are detected—before establishing persistence and harvesting host data.
The malware operates through several distinct functional modules:
- Persistence & Evasion: Stadia drops itself into a randomly named directory within the shared AppData folder, masquerading under a legitimate-sounding process name. It creates a hidden scheduled task set to trigger at logon and every 15 minutes. When running with administrative privileges, it executes PowerShell commands to silently add its installation folder to Microsoft Defender exclusion lists.
- Browser Injection & Key Recovery: To bypass browser defenses, Stadia launches Chromium-based browsers (Chrome, Edge, Brave) in a suspended state and injects a 26 KB code stub into process memory. This stub extracts the master encryption keys, temporarily writes them to disk, and reads protected data from over 50 browsers, 120 cryptocurrency extensions, and 50 desktop wallets.
- Hidden Desktop & C2 Communications: A dedicated HVNC module creates a concealed, parallel desktop session that allows the operator to control the device without visual detection by the victim. The malware communicates with up to three hard-coded command-and-control (C2) servers over HTTP. To evade basic network inspection, the outbound requests claim to carry standard JSON payloads but actually transmit RC4-encrypted, Base64-encoded binary blobs.
Conclusion
Stadia demonstrates how malware operators pivot after infrastructure takedowns, repackaging stolen stealer code into versatile remote access trojans equipped with hidden desktop control. Because its C2 domains, encryption keys, and file names shift between builds, security teams must rely on behavioral detection over static file hashes.
To protect against Stadia, security teams should monitor endpoints for unauthorized scheduled task creations, suspicious process injections targeting suspended browser executables, and PowerShell commands modifying Microsoft Defender exclusion paths. Network administrators should inspect HTTP traffic for content-type mismatches (such as encrypted data streams disguised as JSON) and audit endpoints for unexpected remote management activity.
Following any confirmed infection, organizations must immediately revoke and rotate all active session cookies, web credentials, cryptocurrency wallet access, and application secrets associated with the compromised host.
Source