StealC seller returns with Stadia RAT after Operation Endgame

Hackread reported on 26 October 2026, from research by Varonis, that the seller of the StealC infostealer has returned with Stadia, a remote access trojan (RAT), four months after Operation Endgame disrupted StealC in June 2026. Advertised on a cybercrime forum on 16 October, Stadia combines credential theft with remote control of Windows systems through six modules, including a stealer, a hidden desktop (HVNC), remote command execution and a loader.

According to the article, the stealer targets more than 50 browsers, 120 cryptocurrency browser extensions and 50 desktop wallets. Subscriptions cost $300, $550 or $900 a month, and former StealC customers are offered a free month on the top tier. Varonis found a 26,112-byte component in the sample that is identical, byte for byte, to one in StealC v3.5.

The sample exits on machines set to Russian, Ukrainian, Belarusian, Kazakh or Uzbek, persists through a hidden scheduled task and, with elevated privileges, adds its folder to the Microsoft Defender exclusions. Varonis recommends watching for such behavior on infected machines rather than relying on IP addresses, which change between builds.

Why it matters Takedowns remove servers, not the people, code and customer base behind them. A seller offering former customers a free month is rebuilding a business, and the credentials such a tool harvests feed the same access market that Operation Endgame set out to disrupt.