StealC Returns as Stadia Remote Access Trojan After Operation Endgame

The seller behind the StealC information stealer has returned with a modular remote access trojan months after international authorities disrupted the malware's infrastructure.

Varonis Threat Labs identified the new malware as Stadia and said its code includes StealC components copied byte for byte. Researchers obtained the build shortly after it appeared for sale and tested its control panel against a laboratory system.

Stadia expands the operator's capabilities beyond credential theft. Its six advertised modules include hidden desktop control, a remote command shell, file browsing, process management, an in-memory loader and the original StealC stealer. Hidden desktop functionality can allow an attacker to operate applications and authenticated sessions without displaying those actions to the victim.

The release follows the June 2026 phase of Operation Endgame, when Europol and its partners seized 326 servers and 142 domains associated with several malware families. Authorities said the StealC disruption involved credentials recovered from hundreds of thousands of infected systems.

Varonis found that the seller is attempting to rebuild its customer base by offering former StealC users one month of access to Stadia's highest service tier. The move illustrates how malware operations can recover after infrastructure seizures when developers, customers and distribution channels remain available.

Defenders should monitor for unusual remote desktop behavior, unexpected command-shell activity, new scheduled persistence and credential access from user workstations. Organizations that previously encountered StealC should treat Stadia as a related threat rather than an entirely new malware family.