Security researchers have uncovered the revival of the notorious StealC malware, resurfacing under the name Stadia — a Remote Access Trojan (RAT) bringing back and expanding upon StealC’s capabilities. Stadia was advertised on October 16, 2026, combining password theft with full-scale control over compromised Windows machines. It offers a spectrum of functions including remote command execution, process management, file browsing, and opaque desktop access. The resurgence follows the takedown of StealC earlier this year during Operation Endgame, which dismantled 326 servers and 142 domains. Although StealC’s infrastructure was heavily disrupted in June, surviving code fragments have provided a foundation for Stadia’s design.
From StealC to Stadia: Code Reuse and Upgrades
Experts at Varonis Threat Labs analyzed Stadia’s build and user interface, confirming direct code reuse with StealC. A browser encryption helper shared identical bytes with StealC version 3.5, proving a technical lineage. Stadia isn’t limited to data theft; it comes with six separate modules covering credential theft, hidden desktop control, remote shell commands, a loader, file explorer, and process manager functions.
How Stadia Operates
Stadia uses Hidden Virtual Network Computing (HVNC), enabling the attacker to take over a virtual desktop that remains invisible to the victim. In addition to stealing data from over 50 web browsers, 120 cryptocurrency extensions, and 50 desktop wallets, it targets messaging apps, email clients, gaming sessions, and VPN tools. For the more advanced users, Stadia offers a tiered subscription model: Basic, Team, and Pro — the Pro plan unlocks all six modules. Earlier StealC users receive a complimentary month of Pro access, likely to regain customer loyalty.
The malware arrives as a 32-bit, unsigned Windows executable (~560 KB), built with Visual C++. To conceal its traces, key strings are encrypted using RC4 or encoded in Base64, and most system functions are dynamically resolved at runtime. Language checks prevent infection when Windows regional settings are set to Ukrainian, Belarusian, Russian, Kazakh, or Uzbek. Once active, it drops its components in randomly-named folders under the shared application-data directory and masquerades under legitimate-sounding executable names, mimicking system or trusted software.
Persistence techniques are robust. Stadia installs a hidden scheduled task that runs every 15 minutes and at user login. If it attains elevated privileges, it also manipulates PowerShell to exclude its folder from Microsoft Defender scans. When stealing browser data, it injects code into suspended browser processes like Chrome, Edge, or Brave, extracts encryption keys via temporary files, then deletes those files once done.
Communication with operator infrastructure is handled over HTTP to three hardcoded command-and-control (C2) servers. Though payloads appear as JSON payloads, the content is actually RC4 encrypted and Base64 encoded. Researchers caution that because each build uses different server addresses and keys, looking for behavior-based indicators, rather than relying solely on static signatures, is more effective for detection.
Indicators of Compromise
Key indicators include filenames like stadia_x32.exe, hashes for specific builds (SHA-256, SHA-1, MD5), known domains and IP addresses for primary and fallback C2 infrastructure, and the RC4 encryption key tied to the build. Some artifacts include a stealth scheduled task, a GUI panel domain “stadiadev.cc”, and installs under random subdirectories using names resembling system files. Defenders are urged to monitor suspicious task creation, Defense exclusions via PowerShell, browser credential injection, and inconsistent network data that purports to be JSON but appears encrypted.
Why this matters. Stadia represents a shift from pure credential-stealing malware to a modular RAT that combines stealth, remote control, and crypto-wallet targeting. It erases the line between data theft and system takeover.
As organizations brace for more sophisticated threats, watching for behavior-based signals — like unexpected persistence, hidden VNC sessions, or hunter-style scan anomalies — will be critical. Static defenses may fail against rapidly changing indicators, but vigilance around build artifacts and evasive tactics may offer the edge needed to guard windows systems against this renewed threat.
