The threat actor behind one of the most widely used information-stealing tools of the past few years is back in business. Researchers at Varonis Threat Labs have identified a new remote access trojan called Stadia, advertised on underground forums starting October 16, 2026, that they say was built by the same seller responsible for StealC.

Rebuilding After a Takedown

The comeback follows a significant law enforcement setback for the StealC operation. As part of the broader Operation Endgame crackdown in June 2026, authorities seized 326 servers and 142 domains tied to the malware-as-a-service operation, according to Varonis. That kind of infrastructure seizure typically sets a criminal operation back substantially, cutting off command-and-control channels and customer access overnight.

Rather than disappearing, the seller — who signs posts under the handle “plymouth” — appears to have used surviving code from the StealC project as the foundation for a rebrand. Varonis researchers obtained a build of the new tool, examined its code, and tested its web management panel against one of their own Windows machines to confirm the connection. The clearest piece of evidence: an embedded browser-encryption helper component that matches StealC version 3.5’s equivalent module byte for byte, a level of code reuse that leaves little doubt about shared authorship.

Six Modules, One Subscription

Where StealC focused primarily on harvesting stored credentials and data, Stadia expands the toolkit considerably. The malware bundles six separate capabilities: a traditional data-stealing module, a hidden virtual network computing (HVNC) component for covert remote desktop access, a remote command shell, a malware loader for fetching additional payloads, a file explorer, and a process manager.

The HVNC feature is particularly notable. It lets a criminal operator work inside a separate, invisible desktop session on the victim’s machine — browsing files, running programs, or manipulating settings — without the victim noticing anything unusual happening on their own screen. Combined with file upload, download, and execution capabilities, it effectively gives a buyer full hands-on-keyboard access to an infected PC, not just a one-time credential dump.

On the data-theft side, the seller advertises collection capability spanning more than 50 web browsers, roughly 120 cryptocurrency wallet browser extensions, and around 50 standalone desktop crypto wallets, in addition to messaging apps, gaming platform sessions, email clients, and VPN client credentials.

Pricing follows a tiered subscription model common among modern malware-as-a-service offerings: $300 a month for a Basic tier, $550 for a Team tier, and $900 for the top Pro tier, which is the only package that unlocks all six modules. In a customer-retention move that doubles as evidence of the rebrand’s intent, former StealC subscribers are being offered a free month of the Pro tier — a clear effort to migrate the old customer base onto the new platform.

Built to Evade, Built to Hide

Technically, the sample Varonis examined is an unsigned, 32-bit Windows executable roughly 560 kilobytes in size, compiled with Microsoft Visual C++. It conceals sensitive internal strings using a combination of RC4 encryption and Base64 encoding, and resolves most of the Windows API functions it needs only at runtime, a common technique for frustrating static analysis.

The malware also checks the system’s language settings and will refuse to run if it detects Russian, Ukrainian, Belarusian, Kazakh, or Uzbek configurations — a pattern frequently seen in malware believed to originate from the former Soviet cybercrime ecosystem, where operators avoid infecting machines in their own geographic “home turf.”

Once installed, Stadia drops itself into a randomly named folder under Windows’ shared application-data directory, disguising its executable with a filename designed to resemble legitimate system software. It establishes persistence through a hidden scheduled task that triggers at user logon and then repeats every 15 minutes. When it manages to run with elevated privileges, it goes a step further and uses PowerShell to add its own installation folder to Microsoft Defender’s exclusion list, shielding itself from the built-in antivirus scanner.

For browser credential theft specifically, Stadia launches an unsigned helper process that starts Chrome, Edge, or Brave in a suspended state and injects roughly 26 kilobytes of code into it to extract the browser’s internal encryption key — briefly writing that key out to a temporary text file before deleting it. Network communication with its command-and-control servers uses plain HTTP requests disguised to look like JSON, but the payload inside is actually RC4-encrypted and Base64-encoded data.

Detection Over Blocklists

Varonis cautions that the specific server addresses and encryption keys change from build to build, meaning static indicators like IP addresses or hashes have a short shelf life. The firm recommends defenders instead focus on behavioral signals: unexpected browser process injection, newly created hidden scheduled tasks, unexplained Defender exclusion changes, and HTTP traffic claiming to be JSON that doesn’t actually parse as such.

Notably, the published research does not establish how Stadia is initially delivered to victims — whether through phishing, malicious ads, cracked software, or another vector — nor does it provide an independently verified count of current infections. For now, the clearest lesson is one familiar from the broader malware-as-a-service economy: dismantling infrastructure disrupts an operation, but when the underlying code and the seller’s customer relationships survive, a rebrand can bring the business back online within months.