Researchers Exploit Bug in StealC Infostealer to Collect Evidence

Security researchers have detailed how they discovered and exploited a cross‑site scripting (XSS) vulnerability in a popular infostealer, allowing them to gather crucial evidence about its back-end operations. Ari Novick, a malware researcher at identity security specialist CyberArk, explained in a blog post that the XSS bug was found in the web panel of the StealC variant. “Given the core business of the StealC group involves cookie theft, you might expect the StealC developers to be cookie experts and to implement basic cookie security features, such httpOnly, to prevent researchers from stealing cookies via XSS,” he explained. “The irony is that an operation built around large-scale cookie theft failed to protect its own session cookies from a textbook attack.” The report focused on one StealC user, dubbed “YouTubeTA,” who managed to steal 390,000 passwords and over 30 million cookies via the malware. The XSS exploitation enabled Novick to identify certain characteristics on the threat actor’s computers, including its geolocation, and retrieve active session cookies. Novick claimed most of the victims were on YouTube looking for cracked versions of Adobe Photoshop and Adobe After Effects, when they unwittingly installed StealC. “YouTubeTA was likely using StealC to take over old YouTube accounts, which they then used to promote new samples of StealC,” he explained. By studying hardware fingerprinting, supported languages, time zones and IP addresses connected to the threat actor’s use of StealC, Novick was able to deduce several things about them. Notably, they are using an Apple Pro device with an M3 processor supporting both English and Russian language settings, are based in the Eastern European time zone and access the internet via Ukrainian ISP TRK Cable TV. Pros and Cons of Infostealers Malware-as-a-service (MaaS) operations like StealC offer powerful out-of-the-box capabilities for threat actors like YouTubeTA, who was able to compromise a large group of victims in just a few months, said CyberArk. “This is a clear demonstration of why many threat actors employ the MaaS model,” Novick continued. “By delegating much of the work to other groups, they can specialize and have a more significant impact, much like in traditional industries.” However, by relying on such tools, threat actors also expose themselves to the same software supply chain risks as legitimate businesses. “The StealC developers exhibited weaknesses in both their cookie security and panel code quality, allowing us to gather a great deal of data about their customers,” Novick concluded. “If this holds for other threat actors selling malware, researchers and law enforcement alike can leverage similar flaws to gain insights into, and perhaps even reveal the identities of, many malware operators.”

Cybersecurity researchers have disclosed a cross-site scripting (XSS) vulnerability in the web-based control panel used by operators of the StealC information stealer, allowing them to gather crucial insights on one of the threat actors using the malware in their operations. "By exploiting it, we were able to collect system fingerprints, monitor active sessions, and – in a twist that will surprise no one – steal cookies from the very infrastructure designed to steal them," CyberArk researcher Ari Novick said in a report published last week. StealC is an information stealer that first emerged in January 2023 under a malware-as-a-service (MaaS) model, allowing potential customers to leverage YouTube as a primary mechanism – a phenomenon called the YouTube Ghost Network – to distribute the malicious program by disguising it as cracks for popular software. Over the past year, the stealer has also been observed being propagated via rogue Blender Foundation files and a social engineering tactic known as FileFix. StealC, in the meantime, received updates of its own, offering Telegram bot integration for sending notifications, enhanced payload delivery, and a redesigned panel. The updated version was codenamed StealC V2. Weeks later, the source code for the malware's administration panel was leaked, providing an opportunity for the research community to identify characteristics of the threat actor's computers, such as general location indicators and computer hardware details, as well as retrieve active session cookies from their own machines. The exact details of the XSS flaw in the panel have not been disclosed to prevent the developers from plugging the hole or enabling any other copycats from using the leaked panel to try to start their own stealer MaaS offerings. In general, XSS flaws are a form of client-side injections that allows an attacker to get a susceptible website to execute malicious JavaScript code in the web browser on the victim's computer when the site is loaded. They arise as a result of not validating and correctly encoding user input, allowing a threat actor to steal cookies, impersonate them, and access sensitive information. "Given the core business of the StealC group involves cookie theft, you might expect the StealC developers to be cookie experts and to implement basic cookie security features, such as httpOnly, to prevent researchers from stealing cookies via XSS," Novick said. "The irony is that an operation built around large-scale cookie theft failed to protect its own session cookies from a textbook attack." CyberArk also shared details of a StealC customer named YouTubeTA (short for "YouTube Threat Actor"), who has extensively used Google's video sharing platform to distribute the stealer by advertising cracked versions of Adobe Photoshop and Adobe After Effects, amassing over 5,000 logs that contained 390,000 stolen passwords and more than 30 million stolen cookies. Most of the cookies are assessed to be tracking cookies and other non-sensitive cookies. It's suspected that these efforts have enabled the threat actor to seize control of legitimate YouTube accounts and use them to promote cracked software, creating a self-perpetuating propagation mechanism. There is also evidence highlighting the use of ClickFix-like fake CAPTCHA lures to distribute StealC, suggesting they aren't confined to infections through YouTube. Further analysis has determined that the panel enables operators to create multiple users and differentiate between admin users and regular users. In the case of YouTubeTA, the panel has been found to feature only one admin user, who is said to be using an Apple M3 processor-based machine with English and Russian language settings. In what can be described as an operational security blunder on the threat actor's part, their location was exposed around mid-July 2025 when the threat actor forgot to connect to the StealC panel through a virtual private network (VPN). This revealed their real IP address, which was associated with a Ukrainian provider called TRK Cable TV. The findings indicate that YouTubeTA is a lone-wolf actor operating from an Eastern European country where Russian is commonly spoken. The research also underscores the impact of the MaaS ecosystem, which empowers threat actors to mount at scale within a short span of time, while inadvertently also exposing them to security risks legitimate businesses deal with. "The StealC developers exhibited weaknesses in both their cookie security and panel code quality, allowing us to gather a great deal of data about their customers," CyberArk said. "If this holds for other threat actors selling malware, researchers and law enforcement alike can leverage similar flaws to gain insights into, and perhaps even reveal the identities of, many malware operators."

A cross-site scripting (XSS) flaw in the web-based control panel used by operators of the StealC info-stealing malware allowed researchers to observe active sessions and gather intelligence on the attackers’ hardware. StealC emerged in early 2023 with aggressive promotion on dark web cybercrime channels. It grew in popularity due to its evasion and extensive data theft capabilities. In the following years, StealC's developer added multiple enhancements. With the release of version 2.0 last April, the malware author introduced Telegram bot support for real-time alerts and a new builder that could generate StealC builds based on templates and custom data theft rules. Around that time, the source code for the malware's administration panel was leaked, giving researchers an opportunity to analyze it. CyberArk researchers also discovered an XSS flaw that allowed them to collect browser and hardware fingerprints of StealC operators, observe active sessions, steal session cookies from the panel, and hijack panel sessions remotely. “By exploiting the vulnerability, we were able to identify characteristics of the threat actor’s computers, including general location indicators and computer hardware details,” the researchers say. “Additionally, we were able to retrieve active session cookies, which allowed us to gain control of sessions from our own machines.” CyberArk did not disclose specific details about the XSS vulnerability to prevent StealC operators from quickly pinpointing and fixing it. The report highlights one case of a StealC customer, referred to as ‘YouTubeTA’, who hijacked old, legitimate YouTube channels likely using compromised credentials, and planted infecting links. The cybercriminal ran malware campaigns throughout 2025, collecting over 5,000 victim logs, stealing approximately 390,000 passwords and 30 million cookies (most of them non-sensitive). Screenshots from the threat actor’s panel indicate that most infections occurred when victims searched for cracked versions of Adobe Photoshop and Adobe After Effects. By leveraging the XSS flaw, the researchers could determine that the attacker used an Apple M3-based system with English and Russian language settings, used the Eastern European time zone, and was accessing the internet via Ukraine. Their location was exposed when the threat actor forgot to connect the StealC panel through VPN. This revealed their real IP address, which was linked to Ukrainian ISP TRK Cable TV. CyberArk notes that malware-as-a-service (MaaS) platforms enable rapid scaling but also pose a significant risk of exposure to threat actors. BleepingComputer has contacted CyberArk to ask why they chose to disclose the StealC XSS flaw now. Researcher Ari Novick said that they hope to cause disruption to the operation, since there has been "a spike in recent months in the number of StealC operators, possibly in response to the drama around Lumma a couple of months ago." "By posting the existence of the XSS we hope to cause at least some disruption in the use of the StealC malware, as operators re-evaluate using it. Since there are now relatively many operators, it seemed like a prime opportunity to potentially cause a fairly significant disruption in the MaaS market." Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report