StealC’s seller has returned with Stadia RAT, combining credential theft, hidden desktop control, and remote command execution using code reused from StealC v3.5.
Four months after Europol disrupted StealC during Operation Endgame, its seller has returned with Stadia, a new remote access trojan (RAT) that combines credential theft with remote control of Windows systems.
Hackread.com previously reported on StealC’s use in a FileFix phishing campaign in 2025. New research from cybersecurity firm Varonis shared with Hackread.com shows that Stadia reuses code from StealC v3.5 while adding capabilities beyond information theft.
In June 2026, Operation Endgame disrupted StealC and other malware networks. The operation involved 326 servers and 142 domains, while authorities recovered more than 25 million stolen credentials from 385,000 infected machines.
Stadia RAT Expands Beyond Credential Theft
Advertised on October 16, Stadia offers six modules: a stealer, hidden virtual network computing (HVNC), Remote CMD, a loader, File Explorer and Process Manager. These modules let operators steal credentials, control a hidden desktop, execute commands, transfer files, manage processes and load additional payloads.
The stealer targets more than 50 browsers, 120 cryptocurrency browser extensions and 50 desktop wallets, alongside messaging and gaming applications. Subscriptions cost $300/month for Basic, $550/month for Team, and $900/month for Pro, which includes all six modules. Former StealC customers are being offered a free month on the Pro tier.
Code Reuse and Detection
Varonis Threat Labs obtained a 560,128-byte, 32-bit Windows executable and reverse-engineered it to examine how Stadia works. One finding stood out: researchers located a 26,112-byte Chromium App-Bound Encryption helper inside the sample that was identical, byte for byte, to a component found in StealC v3.5. The match provides concrete evidence that the new RAT reuses code from its predecessor.
The sample also checks the system language before proceeding, exiting on machines configured for Russian, Ukrainian, Belarusian, Kazakh or Uzbek, and installing itself on other systems in a randomly named directory under C:ProgramData. Here it uses filenames resembling legitimate Windows or software update processes like MicrosoftEdgeUpdate.exe and SearchHost.exe.
It then creates a hidden scheduled task that runs at logon and every 15 minutes. If it has elevated privileges, Stadia also uses PowerShell to add its installation directory to Microsoft Defender’s exclusion list.
Its network traffic offers another potential detection clue. Stadia sends HTTP POST requests containing RC4-encrypted data encoded in Base64, even though the requests identify their content as application/json.
In its detailed report, Varonis advises defenders to look beyond IP addresses, which can change between builds, and watch for suspicious behavior on infected machines, including unsigned processes injecting code into suspended browser processes, newly created hidden scheduled tasks and unexpected Microsoft Defender exclusions.
Stadia’s return shows the limits of infrastructure takedowns when the people behind a malware operation retain their code and customer base. By adding remote-control tools to StealC’s credential-stealing capabilities and offering former customers a free month, the seller is attempting to rebuild the business with a broader toolkit.
