#stealc

Attackers cloned a legitimate Oura MCP server to infiltrate AI integration registries, distributing the StealC infostealer to harvest developer credentials, browser data, and crypto wallets.

Source: Straiker

The ClickFix social-engineering campaign used fake CAPTCHA pages to deploy StealC stealer, exfiltrating browser credentials, crypto wallets, and email data.

Source: LevelBlue

A flaw inside the StealC infostealer quietly exposed the inner workings of its operators, revealing campaigns, infrastructure, and stolen session data.

Source: CyberArk Labs

Cybersecurity is an endless war. As long as there are users there will also be threat actors. As long as there is software, there will be those who manipulate and exploit it. There will never be a time when the internet is fully ‘safe’ from threats, no matter how many domains are taken down, how many disruptions are carried out. That doesn’t mean we should fail to acknowledge a win when we get one, though.

Yesterday, with cooperation with Europol and other industry partners as part of Operation Endgame, Microsoft’s Digital Crimes Unit carried out an operation resulting in the takedown, suspension, and blocking of domains and command-and-control (C2) servers that formed the backbone of StealC and Amadey infrastructure (source: Microsoft Threat Intelligence). Together they identified over 200 malicious Amadey and StealC command-and-control domains and IPs and moved to shut them down through a mix of court orders, domain seizures, registrations, and provider notifications. StealC is a fairly well known family of malware-as-a-service. Amadey is a modular loader, the vehicle by which malware like StealC is delivered.

To understand the importance of a disruption like this, one must understand why it matters. In recent months, we’ve been bombarded with large scale, high profile data breaches, often going after links in the supply chain to execute attacks. Salesforce, Oracle’s PeopleSoft and more recently the ErrTraffic campaign are all supply chain hacks, relying either on vulnerabilities in development packages or outright brute force theft of login credentials. There have been widespread downstream effects of these hacks, notably in how much of the data stolen – both directly related and accessed through pivoting into connected enterprises – has ended up exposed when extortion fails. Infostealers are a little different. The goal isn’t necessarily to extort the victim but to sell the data to the highest bidder. Trojan malware works by obfuscating itself, leaving the victim unaware of its presence until it’s too late. Which in turn means that many of them don’t change their credentials because they don’t know they should. The stolen data remains viable.

StealC is opportunistic in nature, mostly distributed through malvertising, although ClickFix versions are readily available. Users tend to want the free download over paying for it, and the ClickFix technique fills that niche, offering anything from allegedly ‘cracked’ popular software to gaming cheats to search engine optimization (SEO) poisoning (which is where search results are injected with false, hijacked or compromised entries). Phishing emails are also a vector for this kind of malware, tricking users into downloading something infected. From there, the malware scrapes and exfiltrates everything it can reach, returning the data to the C2 operator, who then sells it. Stealers are a link in their own form of the supply chain. Given the number of C2 domains, rather typical for these kinds of threat actors, one can see how difficult it is to disrupt the chain as a whole. When one domain gets taken down, they simply shift to another one. It’s why operations like this take such coordination to strike all of them at once. And why there is such an emphasis on hardening security with MFA, credential hygiene and general education regarding these intrusions.

Among the very first reports I published was on the takedown and subsequent return of LummaStealer, which had also been subject to disruption. In a matter of weeks, it was back. That said, the disruption wasn’t pointless by any means. LummaStealer has faded somewhat into the background, either because the current C2 domains have not returned in strength or because the kinds of threat actors that use it are wary of being caught. I’m sure it’s still out there, and malicious operators are still using it. It could very well be that due to higher profile cases being reported on, it’s simply slipping through the cracks of visibility. Cybersecurity is an endless war. I have no doubt that despite the success of this disruption by Microsoft, we haven’t seen the last of StealC either. But for now, let us celebrate a rare win.

Three weeks into the new year and I feel like I’ve written about as much good news as I have bad. First there was Resecurity’s honeypot scheme that caught the Scattered Lapsus$ Hunters group. Then there was the disruption of RedVDS by Microsoft Threat Intelligence. Just a few days ago, I wrote about the ongoing collaborative effort to subdue AISURU/Kimwolf. And now there is CyberArk Labs’ successful intrusion into StealC, a fairly common malware-as-a-service.

StealC, as the name implies, is an infostealer that focuses mainly on harvesting session cookies, passwords and other sensitive data from compromised devices. And before we get too far into the breakdown of this counter-attack, let me define what cookies actually are.

Cookie are temporary files that websites use to store data while a user is navigating said site. If you’ve ever visited a site and gotten a popup warning you that cookies are in use – usually with options for how they will be utilized, how long they will be stored and what data they collect – then you are familiar with the process. Operated correctly, most of them delete your personal data when you close your browser, thereby ending your session. Some browsers even have internal settings to control cookies, adding another layer of protection. Infostealers like StealC harvest credentials while a session is active, then keep that data for their own exploitation. They often slip under the radar of antiviral software because they have just enough infrastructure to look legitimate, or have hijacked a genuine application to work in the background of it.

Cookies have been a part of how the internet functions since nearly the beginning of the modern digital age. Before their invention, sessions were not tracked, which sounds great from a privacy perspective, but means that maintenance of logins, account preferences and checkout pages could not be managed. The early world wide web was considered a ‘stateless’ architecture. HTTP requests had nowhere to be logged, traffic flowed in isolation from host to client. And when it was over, it was over. No memory remained. Cookies changed all of that. At the time of their inception in the mid-1990’s, the digital landscape was much smaller and less complex, and the implications of tracking sessions hadn’t been fully realized yet. No one had considered compiling the metrics of internet use, nor had the concept of things like targeted advertising been born.

And infostealers were not as sophisticated as they are now. Although, for all their intricacies in gathering data, apparently they aren’t necessarily that good at protecting their own. Which is what CyberArk Labs exploited for themselves. Their ‘reverse uno’ tactic worked because StealC’s own infrastructure had not covered the possibility of their own cookies being harvested.

In early 2025, StealC underwent an upgrade to a new version and almost immediately had the technical details of its infrastructure leaked. This is when CyberArk discovered a vulnerability that allowed them to observe the malware and its operators, collecting system fingerprints, monitor active sessions...and steal cookies. In the article linked above, they go on to explain the research garnered from one threat actor, although they state that no specifics have been given in order to prevent patching of this particular vulnerability in the future. With any luck, this research will give cybersecurity agencies the ability to more accurately track StealC and, more importantly, prevent and mitigate it.