Active threat familyWindowsCredential theft
Malware Intelligence

StealC

StealC is a fileless infostealer sold since January 2023 by a developer using the alias "Plymouth". It draws on Vidar, Raccoon, Mars and RedLine; its data collection settings are configured flexibly from the panel.

Activity map

Activity mapJavaScriptUser pastesCommandExecutionInjectionPackagingExfiltrationUser typesDownloadsFake verificationpageClickFixCommand copiedto the clipboardRun dialogWin + RPowerShellDownloaderDownload from aremote serverPayloadStealCInfostealerilasm.exeDark Radar 54%Data collection28 targetsLog archiveC2 serverTikTok videoFree softwarePowerShellManually typed commandDownload from aremote serverScript
Executable payloadFileDark Radar evidence
Malicious payloadStealC · Infostealer

StealC is a fileless infostealer sold since January 2023 by a developer using the alias "Plymouth". It draws on Vidar, Raccoon, Mars and RedLine; its data collection settings are configured flexibly from the panel.

Appears in flows

Environment information

  • Operating system
  • Hardware
  • IP and location
  • Installed software
  • Screenshot
  • Desktop files

Credentials and application data

  • Saved passwords
  • Session cookies
  • Autofill
  • Saved cards
  • Steam
  • Discord
  • Telegram
  • Microsoft Outlook
  • Electrum
  • FileZilla
  • Battle.net
  • Binance Wallet
  • MetaMask
  • Phantom
Dark Radar infection records
1,847,820
Latest infection record
29 October 2026
Malware type
Infostealer
First seen
January 2023
01

Overview

Because of its light footprint and flexible configuration, it is often used in loader chains and ClickFix campaigns.

Ranks 6 of 52 families in Dark Radar data, with 1,847,820 infection records.

02

Origin and evolution

  1. January 2023Went on sale on Russian-language forums.Malpedia (Fraunhofer FKIE)
  2. 2023Early technical analyses documented that it decrypts browser data by downloading seven legitimate DLLs.VMRay
  3. 2025The second major version added encrypted JSON communication and downloading of EXE/MSI/PowerShell payloads.Zscaler
  4. 2025Distributed through ClickFix campaigns.LevelBlue SpiderLabs
03

Technical profile

Malware typeInfostealer
Target operating systemWindows
Primary purposeData theft
Threat categoryCredential theft
Programming languageC (WinAPI)
Distribution modelSubscription service (MaaS)
First seenJanuary 2023
Infected systemsWindows 11 65%, Windows 10 33.5%
Public source confidenceHigh
04

Targeted applications

28 applications8 categories
05

Data collection

Credentials

  • Browser passwords77.5%Verified
  • Session cookies92%Verified
  • Refreshing expired sessions—
  • Autofill84%Verified
  • macOS Keychain—
  • 2FA and password managers—

Financial

  • Saved cards9%Dark Radar observation
  • Desktop crypto wallets12.5%Verified
  • Wallet extensionsVerified
  • Clipboard address replacement—

Applications

  • Email clients8.5%Verified
  • FTP clients3.5%Dark Radar observation
  • VPN clients—
  • Messaging applications17.5%Verified
  • Gaming platforms25.5%Dark Radar observation

System

  • File collectionVerified
  • ScreenshotVersion-dependent
  • System inventory100%Verified

Behavior

  • Additional payload downloadVerified
  • Persistence—
  • Anti-analysisVerified
06

File system

User profile (%USERPROFILE%)
File details are in Dark Radar IntelligenceOpen in Intelligence
07

System components

  • System and hardware information
  • Installed software
  • Language and region check (does not run in CIS countries)
08

How it works

  1. 1Infection

    • ClickFix fake verification pages.
    • "Free software" tutorials on video platforms.
    • Loader chains.

    Breaking point: Email attachments, sponsored ad links and unlicensed software downloads are blocked at the email and web gateway.

  2. 2Execution and evasion

    • Runs without persisting on disk.
    Dark Radar observation

    The payload ran from the temporary folder (latest 200 logs, 38.5%).

    Ran inside the legitimate ilasm.exe process (latest 200 logs, 54%).

    T1204.002User Execution: Malicious FileT1204.004User Execution: Malicious Copy and PasteT1059.001PowerShellT1027Obfuscated Files or InformationT1497Virtualization/Sandbox EvasionT1070.004File Deletion

    Breaking point: Unsigned files running from user folders and injections into .NET tools are stopped by application control and EDR.

  3. 3Discovery

    • Language and virtual environment checks, followed by a system inventory.
    Dark Radar observation

    Infected systems: Windows 11 65%, Windows 10 33.5%.

    T1082System Information DiscoveryT1614System Location Discovery

    Breaking point: Bulk system and security software queries from a short-lived process trigger an EDR alert.

  4. 4Data collection

    • Browser data is decrypted by downloading seven legitimate DLLs, including sqlite3.dll, nss3.dll and mozglue.dll.
    • Wallet, extension and application data is collected.
    Dark Radar observation

    Data found in the latest 200 logs: password file 77.5%, cookies 92%, autofill 84%, cards 9%, wallets 12.5%.

    T1555.003Credentials from Web BrowsersT1539Steal Web Session CookieT1005Data from Local System

    Breaking point: A process other than the browser reading browser profile files is blocked or triggers an alert.

  5. 5Exfiltration and C2

    • Data is sent file by file with HTTP POST.
    T1071.001Web ProtocolsT1041Exfiltration Over C2 ChannelT1105Ingress Tool Transfer

    Breaking point: Traffic to newly registered domains, direct IP addresses and non-standard ports is blocked.

  6. 6Persistence and aftermath

    • Downloads additional payloads; deletes itself at the end.

    Breaking point: When an infection is confirmed, all sessions and access tokens on the device are revoked.

09

Network communication

This section is in Dark Radar IntelligenceOpen in Intelligence
10

MITRE ATT&CK

Execution
Credential Access
Discovery
Collection
Command and Control
Exfiltration
Defense Evasion
11

IOCs and detection

This section is in Dark Radar IntelligenceOpen in Intelligence
12

Risk and impact

  • Additional payloads distributed from the panel can be ransomware or remote access tools.
  • Stolen session cookies are enough to take over cloud, email and SaaS sessions without a password or multi-factor authentication prompt.
  • Corporate passwords saved on personal devices also leak through infections outside the corporate network; these logs are sold to initial access brokers.
  • Log archives are reshared for years; as long as the password is not changed, the same credential can be used again and again.
  • Compromised email, messaging and social media accounts become the next link in phishing and malware distribution.
13

Defense

  • Block unsigned processes that drop DLLs under ProgramData.
  • When an infection is detected, revoke not only the password but all related sessions and access tokens.
  • Turn off password saving in the browser through corporate policy; use a corporate password manager.
  • Move to phishing-resistant multi-factor authentication (FIDO2/passkey); bind sessions to the device.
  • Block setup files downloaded from unlicensed software, game cheats and sponsored search results.
  • Monitor flows where the user runs a command by pasting it into the Run dialog or terminal (ClickFix) with endpoint rules.
  • Continuously monitor your corporate domains and employee email addresses in stealer logs with Dark Radar.
14

Learning center

How does this malware spread?
  • ClickFix fake verification pages.
  • "Free software" tutorials on video platforms.
  • Loader chains.
  • The payload ran from the temporary folder (latest 200 logs, 38.5%).
How can its presence on a system be detected?
  • Sign-ins to accounts from an unrecognized country or device.
  • A new infostealer log in Dark Radar for your corporate domain or an employee email address.
Which Windows artifacts should be examined?
  • Prefetch (C:\Windows\Prefetch) — shows that a short-lived payload ran.
  • Amcache.hve and ShimCache — path and hash of the executed file.
  • Downloads folder and Zone.Identifier stream — the address the file was downloaded from.
  • Browser history — the fake download page or fake CAPTCHA address.
  • RunMRU registry key — commands pasted into the Run dialog.
  • Randomly named folders and DLLs under %TEMP% and %LOCALAPPDATA%.
Which log records matter?
  • Sysmon Event 1 / Security 4688Process creation: unsigned processes starting from Temp and Downloads folders, mshta, powershell -enc chains.
  • Sysmon Olay 11 / 23File creation and deletion: self-deleting payloads, DLLs dropped under Temp.
  • Sysmon Olay 3 / 22Network connection and DNS query: to newly registered domains, C2 resolution via Telegram, Steam or Pastebin.
  • Object access auditing (4663)A process other than the browser reading Login Data, Cookies and Local State files.
  • PowerShell 4104Script block logging: obfuscated downloader commands.
  • Identity provider sign-in logsSessions after the infection from a different country and device, without a multi-factor authentication prompt.
Which MITRE techniques is it associated with?
T1204.002User Execution: Malicious FileT1555.003Credentials from Web BrowsersT1539Steal Web Session CookieT1082System Information DiscoveryT1005Data from Local SystemT1071.001Web ProtocolsT1041Exfiltration Over C2 ChannelT1204.004User Execution: Malicious Copy and PasteT1059.001PowerShellT1105Ingress Tool TransferT1027Obfuscated Files or InformationT1497Virtualization/Sandbox EvasionT1070.004File DeletionT1614System Location Discovery
How should a SOC analyst respond?
  1. Isolate the device from the network; do not reinstall it before taking memory and disk images.
  2. Determine the infection date; list all accounts that were signed in on the device after that date.
  3. Change the passwords of these accounts, revoke their sessions and access tokens, and re-enroll multi-factor authentication devices.
  4. Search identity provider and SaaS logs for new country, device and token usage after the infection.
  5. If a recovery phrase or wallet file was exposed, move the assets to a new wallet.
  6. Find the initial access path (email, ad, unlicensed software, fake CAPTCHA) and check other users who used the same path.
  7. Reinstall the device from a clean image.
15

Sources

Related families

VidarArkeiLumma StealerCompare

Related terms

Botnet panel rentalInfostealerMalware familyOpen-source intelligenceClickFix
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans