Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

StealC seller advertises Stadia as paid Windows RAT

2 sources · 2 articlesFirst reported Updated ()1 · 1 read
What's new

October 23: Coverage specifies Stadia 1.1.2’s hash and 560,128-byte size, the $550 tier, a free Pro month, and about 27 million credentials recovered in June.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Varonis says the StealC seller advertised Stadia on October 16 as a paid Windows RAT for theft and remote control; infections remain unconfirmed.

According to Varonis Threat Labs, the StealC seller advertised Stadia on October 16, 2026, a Windows RAT that keeps the infostealer and adds hidden desktop control, commands, and a loader. The offer follows June’s Operation Endgame action against StealC. GBHackers says Europol actioned 326 servers and 142 domains and recovered about 27 million credentials; Cyber Security News attributes the seizures to Varonis and omits that figure. Version 1.1.2 uses three HTTP servers, a scheduled task, and Defender exclusions when elevated, and skips five regional locales. Plans cost $300, $550, or $900 a month; only Pro includes all six modules, and former buyers get one free Pro month, Cyber Security News says. Neither outlet confirms delivery or an infection count.

Key facts
  • Tested build is unsigned 32-bit stadia_x32.exe version 1.1.2, 560,128 bytes.
  • GBHackers publishes SHA-256 ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e.
  • Seller claims over 50 browsers, 120 crypto extensions, and 50 desktop wallets.
  • Tiers are Basic $300, Team $550, and Pro $900 a month.
  • Only Pro includes all six modules; former buyers get one free month.
  • Sample skips five locales and beacons to three hard-coded HTTP servers.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 16, 2026StealC seller advertised the Stadia Windows RAT. · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersStealC 3.5.0 changelog, sample hash, ProgramData task, and credential recovery.
  • Cyber Security NewsByte-identical StealC 3.5 helper, file size, free Pro month, no victim count.
Vendors
Microsoft
Products
Microsoft DefenderGoogle ChromeMicrosoft EdgeBraveWindows
Malware
StadiaStealCAmadeySocGholish
Organizations
Varonis Threat LabsEuropol

Coverage

oldest first · one row per article · UTC
  1. · 2d ago GBHackersFirst report

    StealC seller returns with Stadia remote access trojan

    Varonis says the October 16 offering adds hidden desktop, command execution and loaders on top of StealC 3.5.0 theft.

  2. · 2d ago Cyber Security News

    StealC seller relaunches as Stadia RAT for Windows

    Version 1.1.2 adds hidden desktop control, a shell, and a loader; Varonis ties its helper to StealC 3.5.