Stealc Stealer: What It Steals and How to Remove It - 2

Do it yourself · free Remove Stealc stealer yourself 5 steps, 15 minutes, no software needed.

Stealc stealer: summary

Facts checked on 25 October 2026 against Malpedia's entry for Stealc, Zscaler ThreatLabz's report on version 2, two reports ClickFix lures and Microsoft Learn's page on Defender Offline, plus the abuse.ch ThreatFox radar data held by our system. We made no site request, downloaded no sample and infected no PC; the removal steps follow Microsoft's page and were not tried on a live infection.

What Stealc is, and whether it is a virus

Stealc is a malicious program for Windows that steals data. It is not something you install on purpose, and there is nothing in it for you. It is sold to criminals who run it against victims and then use or resell what it collects. Calling it a virus is common, though the exact word is information stealer, or infostealer.

1 What it is Malpedia, a public catalogue of malware families, records that Stealc was first offered for sale on 9 January 2023 as a malware as a service product. That means the author rents it to buyers, who do not need to write any code themselves. The presumed developer used the name Plymouth on Russian speaking underground forums.

Malpedia, a public catalogue of malware families, records that Stealc was first offered for sale on 9 January 2023 as a malware as a service product. That means the author rents it to buyers, who do not need to write any code themselves. The presumed developer used the name Plymouth on Russian speaking underground forums.

2 What it is built from Malpedia says the stealer is written in C, uses Windows system calls and is non resident, which means it does its job and leaves rather than staying on the PC for months. The seller claimed it draws on the work behind older stealers called Vidar, Raccoon, Mars and RedLine. That is the seller's claim, not something we could verify.

What it is built from

Malpedia says the stealer is written in C, uses Windows system calls and is non resident, which means it does its job and leaves rather than staying on the PC for months. The seller claimed it draws on the work behind older stealers called Vidar, Raccoon, Mars and RedLine. That is the seller's claim, not something we could verify.

3 Why people for it Most people meet the name in a Defender alert, in a message from a security tool, in a leaked log of stolen accounts, or after an account of theirs was taken over. The short answer to all of them is the same: if a file or command that you ran turns out to be Stealc, treat every saved password and every login session on that PC as copied.

Why people for it

Most people meet the name in a Defender alert, in a message from a security tool, in a leaked log of stolen accounts, or after an account of theirs was taken over. The short answer to all of them is the same: if a file or command that you ran turns out to be Stealc, treat every saved password and every login session on that PC as copied.

4 What we know this page's evidence The radar that triggered this guide shows 12 entries for Stealc in abuse.ch ThreatFox, the latest dated 21 October 2026. We did not open those entries, so we cannot tell you which servers or versions they name. This guide rests on the vendor and catalogue pages listed at the end, and says plainly where those are silent.

What we know this page's evidence

The radar that triggered this guide shows 12 entries for Stealc in abuse.ch ThreatFox, the latest dated 21 October 2026. We did not open those entries, so we cannot tell you which servers or versions they name. This guide rests on the vendor and catalogue pages listed at the end, and says plainly where those are silent.

What Stealc stealer does on an infected PC

What our check covers, and what it does not

There is no website to test here, so there is no site test. Our server made no request, because the subject is a malware family name, not an address. Everything below comes from vendor and catalogue pages we read on 25 October 2026 and from the radar data of the abuse.ch ThreatFox project.

What we did and did not do, 25 October 2026

ThreatFox radar 12 entries for the malware name Stealc; the newest was added on 21 October 2026 and our links point to entries dated 18, 19, 20 and 21 October.

What the entries contain Not read. We do not know whether they are servers, addresses or files, which version they belong to, or whether they are still online.

Vendor and catalogue pages We read Malpedia's entry and Zscaler ThreatLabz's version 2 analysis, and two reports the lures that deliver Stealc.

Samples and infected PCs We downloaded no sample and infected no PC. The steps below follow Microsoft's published pages and were not tried on a live infection.

Microsoft detection name We could not read a Microsoft Security Intelligence page for Stealc, so we name no Microsoft detection and do not guess one.

Dangerous: a real malware family that is still seen The danger rating rests on the vendor descriptions and on the October 2026 entries. A quiet scan of one PC does not clear it, because a stealer that already finished its job may leave nothing running.

Stealc from 2023 to October 2026

The family is almost four years old and has been rebuilt at least once. The dates come from Malpedia, Zscaler and the radar data; where a source gives only a month, we say so.

October 2024 Detailed teardown of the first version Malpedia lists a three part analysis by the French firm Lexfo from this month. We did not read it; we note it because it shows the first version was still being studied in late 2024.

Detailed teardown of the first version

Malpedia lists a three part analysis by the French firm Lexfo from this month. We did not read it; we note it because it shows the first version was still being studied in late 2024.

March 2025 Version 2 appears Zscaler ThreatLabz says version 2 was introduced this month, with a simpler JSON based protocol for talking to the server and, in the latest variants, RC4 encryption of the traffic.

Zscaler ThreatLabz says version 2 was introduced this month, with a simpler JSON based protocol for talking to the server and, in the latest variants, RC4 encryption of the traffic.

1 May 2025 Zscaler publishes its comparison Its report, titled I StealC You, compares the two versions and says the newer one dropped some features of the old one while adding a builder, a file grabber and more ways to deliver extra malware.

Zscaler publishes its comparison

Its report, titled I StealC You, compares the two versions and says the newer one dropped some features of the old one while adding a builder, a file grabber and more ways to deliver extra malware.

June 2026 A disruption is listed Malpedia's reference list includes a Europol note and a Bitsight note from June 2026 Stealc and Amadey becoming unavailable in a coordinated action. We did not read those two pages, so we cannot say how complete the disruption was, and the October reports show the name still appears.

A disruption is listed

Malpedia's reference list includes a Europol note and a Bitsight note from June 2026 Stealc and Amadey becoming unavailable in a coordinated action. We did not read those two pages, so we cannot say how complete the disruption was, and the October reports show the name still appears.

18 to 21 October 2026 New entries in ThreatFox The radar data shows entries added on four consecutive days, 12 for the family in total, the newest on 21 October. This is a count and dates only; we did not read what they point to.

18 to 21 October 2026

New entries in ThreatFox

The radar data shows entries added on four consecutive days, 12 for the family in total, the newest on 21 October. This is a count and dates only; we did not read what they point to.

What the pattern suggests, and what it does not: a family that is still logged four months after a reported disruption has either recovered or been picked up by copies of the software. That is our reading of the dates; no source we read says which.

How Stealc works, step by step

Stealc is a quick job. It starts, gathers what it was told to gather, sends it and may then stop. This is why the damage is usually done before anyone notices, and why deleting the file afterwards is the smaller part of the cleanup.

1 It is started by you, not by an exploit The reports we read describe campaigns in which the victim runs something: a file from a fake download page, or a command pasted from a page that claims to fix an error. Windows does not need a flaw for this. The program runs with your own rights, so it sees every file and browser profile you can see.

It is started by you, not by an exploit

The reports we read describe campaigns in which the victim runs something: a file from a fake download page, or a command pasted from a page that claims to fix an error. Windows does not need a flaw for this. The program runs with your own rights, so it sees every file and browser profile you can see.

2 It hides its own code Zscaler says many version 2 samples are packed with Themida, a commercial protection tool, and that nearly all of the program's text strings are scrambled and unscrambled in two stages. This makes it harder for analysts and for simple scanners to read. It is not a sign that the file is rare; it is a common way to delay detection.

It hides its own code

Zscaler says many version 2 samples are packed with Themida, a commercial protection tool, and that nearly all of the program's text strings are scrambled and unscrambled in two stages. This makes it harder for analysts and for simple scanners to read. It is not a sign that the file is rare; it is a common way to delay detection.

3 It reports in and receives its orders The program contacts the operator's server and receives settings what to take. Zscaler describes a control panel with a builder that sets rules by country, hardware ID and installed software, so two victims can get different results from the same file. A secondary summary also mentions checks that avoid duplicate runs; we did not confirm that in the primary report.

It reports in and receives its orders

The program contacts the operator's server and receives settings what to take. Zscaler describes a control panel with a builder that sets rules by country, hardware ID and installed software, so two victims can get different results from the same file. A secondary summary also mentions checks that avoid duplicate runs; we did not confirm that in the primary report.

4 It collects According to Malpedia it targets web browser data, browser extensions, desktop crypto wallets, messengers and email clients. It fetches seven ordinary helper libraries, such as sqlite3 and the Firefox support libraries, to read browser databases. Zscaler adds a unified file grabber, screenshots of several monitors and, on the server side, guessing of passwords.

According to Malpedia it targets web browser data, browser extensions, desktop crypto wallets, messengers and email clients. It fetches seven ordinary helper libraries, such as sqlite3 and the Firefox support libraries, to read browser databases. Zscaler adds a unified file grabber, screenshots of several monitors and, on the server side, guessing of passwords.

5 It uploads Malpedia says the stolen items are sent one by one to the server in HTTP POST requests. Zscaler says version 2 packs these into JSON and, in the newest variants, encrypts them with RC4. A firewall rule that only watches for file types will not see anything unusual.

Malpedia says the stolen items are sent one by one to the server in HTTP POST requests. Zscaler says version 2 packs these into JSON and, in the newest variants, encrypts them with RC4. A firewall rule that only watches for file types will not see anything unusual.

6 It may add more malware Zscaler describes Stealc as a stealer and a downloader. Version 2 can fetch and start extra programs as EXE files, MSI installers or PowerShell scripts. So the PC that lost its passwords may also be given something else, which is why a full cleanup, not a single file delete, is the answer.

It may add more malware

Zscaler describes Stealc as a stealer and a downloader. Version 2 can fetch and start extra programs as EXE files, MSI installers or PowerShell scripts. So the PC that lost its passwords may also be given something else, which is why a full cleanup, not a single file delete, is the answer.

7 Whether it stays Zscaler's comparison table lists persistence as absent in both versions, so by itself Stealc does not set up a task or a registry entry to start again. Some sandbox reports from other sites say otherwise, and the extra malware it downloads may persist. Treat a clean startup list as helpful, not as proof.

Zscaler's comparison table lists persistence as absent in both versions, so by itself Stealc does not set up a task or a registry entry to start again. Some sandbox reports from other sites say otherwise, and the extra malware it downloads may persist. Treat a clean startup list as helpful, not as proof.

What Stealc stealer can steal or download

What Stealc can take from a Windows PC

The list below is what the vendor descriptions name. Which items one infection took depends on the buyer's settings, so use it as a worst case when deciding what to change.

Saved browser passwords

Browser cookies and session logins

Browser autofill and card data

Browser extensions, including wallet extensions

Desktop crypto wallet files

Files found by a file grabber

Screenshots of every monitor

Extra malware downloaded afterwards

What this can cost you

The cost is not on your PC. It shows up later, on your accounts, so the sooner you cut off the stolen logins the less there is to lose.

High Account takeover Saved passwords and session cookies let someone sign in to your mail, social media and shopping accounts. A stolen session can work even when two step sign in is on, until the session is ended.

Saved passwords and session cookies let someone sign in to your mail, social media and shopping accounts. A stolen session can work even when two step sign in is on, until the session is ended.

High Crypto loss A stolen wallet file or seed phrase gives the thief the funds. Crypto sent away cannot be called back.

A stolen wallet file or seed phrase gives the thief the funds. Crypto sent away cannot be called back.

High Work and business accounts If you signed in to a work account in the same browser, that login may be part of the haul. Tell your employer's security team quickly.

Work and business accounts

If you signed in to a work account in the same browser, that login may be part of the haul. Tell your employer's security team quickly.

Medium Cards and payment data Autofill data saved in a browser can include card numbers. Watch statements and ask your bank a replacement card.

Cards and payment data

Autofill data saved in a browser can include card numbers. Watch statements and ask your bank a replacement card.

Medium More malware on the same PC Stealc can download other programs, so the PC may carry a second infection that does remain.

More malware on the same PC

Stealc can download other programs, so the PC may carry a second infection that does remain.

Low Nothing, if you only saw the name A name in a news item, a list or a block message is not an infection.

Nothing, if you only saw the name

A name in a news item, a list or a block message is not an infection.

What you may notice, and what you may not

Because Stealc is short and quiet, many people notice nothing on the PC. The first sign is often an account that behaves strangely.

How to check the PC for Stealc stealer

How people end up running Stealc

Nobody visits a Stealc server by choice. The program arrives because you were persuaded to run it. The routes below are the ones we found in reports; they are examples, not a full list.

1 ClickFix pages Proofpoint named the ClickFix trick and reported it in email phishing from March 2024. A page shows a fake error and tells you to press a key combination and paste a command into Windows. The command downloads and starts the stealer. Reporting on later waves includes fake CAPTCHA pages on hacked websites that lead to Stealc.

Proofpoint named the ClickFix trick and reported it in email phishing from March 2024. A page shows a fake error and tells you to press a key combination and paste a command into Windows. The command downloads and starts the stealer. Reporting on later waves includes fake CAPTCHA pages on hacked websites that lead to Stealc.

2 Fake meeting pages Sekoia described a ClickFix campaign with fake Google Meet pages that claimed your microphone or headset was broken. On Windows the fix it offered installed the Stealc stealer or another one called Rhadamanthys. The same campaign had a version for macOS with different malware.

Sekoia described a ClickFix campaign with fake Google Meet pages that claimed your microphone or headset was broken. On Windows the fix it offered installed the Stealc stealer or another one called Rhadamanthys. The same campaign had a version for macOS with different malware.

3 Fake downloads and bundles We found no vendor report that ties Stealc to cracked software specifically, so we do not claim it. Stealers in general are often spread this way, and any program from an unofficial site is a risk.

Fake downloads and bundles

We found no vendor report that ties Stealc to cracked software specifically, so we do not claim it. Stealers in general are often spread this way, and any program from an unofficial site is a risk.

4 Loaders that bring it along Malpedia lists Stealc among tools that other malware can drop. If one infection is found on a PC, assume that a stealer was a possible companion.

Loaders that bring it along

Malpedia lists Stealc among tools that other malware can drop. If one infection is found on a PC, assume that a stealer was a possible companion.

Check your PC before you delete anything

Start with the question that matters: did you run a file from an unofficial page, or paste a command because a page told you to? If yes, or if you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and do the account changes on another device.

1 Disconnect first Turn off Wi-Fi or unplug the network cable. A stealer that is still running or has downloaded a second program needs the connection.

Turn off Wi-Fi or unplug the network cable. A stealer that is still running or has downloaded a second program needs the connection.

2 Open Protection history In Windows Security > Virus & threat protection > Protection history , look for a detection around the time you ran the file. Microsoft says the offline scan results appear in the same place.

Open Protection history

In Windows Security > Virus & threat protection > Protection history , look for a detection around the time you ran the file. Microsoft says the offline scan results appear in the same place.

3 Look at the programs that are running Open Task Manager and sort the Processes tab by network and CPU. Look for unknown names, or a program with random letters. A stealer that has finished will not be listed, so an empty result clears nothing.

Look at the programs that are running

Open Task Manager and sort the Processes tab by network and CPU. Look for unknown names, or a program with random letters. A stealer that has finished will not be listed, so an empty result clears nothing.

4 Check installed apps In Settings > Apps > Installed apps sort by install date. Anything you did not install on the day you ran the suspect file is worth a look.

In Settings > Apps > Installed apps sort by install date. Anything you did not install on the day you ran the suspect file is worth a look.

5 Check Startup apps In Settings > Apps > Startup look for names you do not know. Zscaler says Stealc itself has no persistence, but a second program it downloaded may have.

In Settings > Apps > Startup look for names you do not know. Zscaler says Stealc itself has no persistence, but a second program it downloaded may have.

6 Check Defender exclusions In Windows Security > Virus & threat protection > Manage settings > Exclusions , look for folders you did not add. We found no source saying Stealc does this, so a clean list is not proof.

Check Defender exclusions

In Windows Security > Virus & threat protection > Manage settings > Exclusions , look for folders you did not add. We found no source saying Stealc does this, so a clean list is not proof.

7 Check your accounts from another device Look at sign in activity for email, bank, social media and exchange accounts, and at crypto balances. This tells you more than any file check.

Check your accounts from another device

Look at sign in activity for email, bank, social media and exchange accounts, and at crypto balances. This tells you more than any file check.

8 A scan helps, but it does not clear the PC A scan with Microsoft Defender or another product finds known files only. Treat a clean result as one data point.

A scan helps, but it does not clear the PC

A scan with Microsoft Defender or another product finds known files only. Treat a clean result as one data point.

How to remove Stealc stealer

A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.

1 Step 1 : Delete scheduled tasks that bring it back Programs like Stealc stealer add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler , open Task Scheduler Library and sort by Last Run Time to see what ran recently. On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete . Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 1 : Delete scheduled tasks that bring it back

Programs like Stealc stealer add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler , open Task Scheduler Library and sort by Last Run Time to see what ran recently.

On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete .

Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.

Full procedure with screenshots: Remove what malware leaves behind in Windows

2 Step 2 : Remove it from startup Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component. Right-click an entry and choose Open file location to see where it runs from: programs in %AppData% or %Temp% deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check. Full procedure with screenshots: Stop apps from opening at startup On uGetFix

Step 2 : Remove it from startup

Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.

Right-click an entry and choose Open file location to see where it runs from: programs in %AppData% or %Temp% deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.

Full procedure with screenshots: Stop apps from opening at startup On uGetFix

3 Step 3 : Delete the folders left behind Uninstalling often leaves the program's folders, and some threats reinstall themselves from them. Press Windows + R , type %LocalAppData% and press Enter, then do the same for %AppData% and %ProgramData%, and look for folders named after Stealc stealer, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too. If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 3 : Delete the folders left behind

Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.

Press Windows + R , type %LocalAppData% and press Enter, then do the same for %AppData% and %ProgramData%, and look for folders named after Stealc stealer, its publisher or created on the day the problem started.

Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.

If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.

Full procedure with screenshots: Remove what malware leaves behind in Windows

4 Step 4 : Scan the PC, then run the offline scan A scan finds the parts of Stealc stealer that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options , start a Full scan and quarantine what it reports. Follow it with Microsoft Defender Antivirus (offline scan) > Scan now , which restarts the PC and checks the disk while Windows and the malware are not running. It takes 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean. Full procedure with screenshots: Run a Microsoft Defender Offline scan

Step 4 : Scan the PC, then run the offline scan

A scan finds the parts of Stealc stealer that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options , start a Full scan and quarantine what it reports.

Follow it with Microsoft Defender Antivirus (offline scan) > Scan now , which restarts the PC and checks the disk while Windows and the malware are not running.

It takes 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.

Full procedure with screenshots: Run a Microsoft Defender Offline scan

5 Step 5 : Change passwords from another device and sign out other sessions Stealc stealer can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft. Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules. Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean. Full procedure with screenshots: Turn on two-step verification / secure a hacked account

Step 5 : Change passwords from another device and sign out other sessions

Stealc stealer can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.

Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.

Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.

Full procedure with screenshots: Turn on two-step verification / secure a hacked account

If you use a Mac, an iPhone or an Android phone

Everything we read describes Stealc as a Windows program. The ClickFix campaign Sekoia described had a separate macOS branch, with different malware, not Stealc.

After removal: passwords, accounts and prevention

Clean up: protect what was taken, then the PC

The order is not the one people expect. Cut off the stolen logins first, from another device, because that is where the loss happens. Then clean the PC.

1 Sign out every session and change passwords from a clean device Start with email, because it resets everything else, then bank, work, social media, cloud storage and exchanges. Use each service's option to sign out of all devices. Stolen cookies can keep a session alive, so changing only the password is not enough.

Sign out every session and change passwords from a clean device

Start with email, because it resets everything else, then bank, work, social media, cloud storage and exchanges. Use each service's option to sign out of all devices. Stolen cookies can keep a session alive, so changing only the password is not enough.

2 Turn on two step sign in with an app or a key Use an authenticator app or a security key where the service offers it. Update recovery email addresses and phone numbers while you are there.

Turn on two step sign in with an app or a key

Use an authenticator app or a security key where the service offers it. Update recovery email addresses and phone numbers while you are there.

3 Move crypto first if a wallet was on the PC If a wallet file or seed phrase was ever on the PC, assume it is known. Make a new wallet and a new recovery phrase on a clean device and move the funds.

Move crypto first if a wallet was on the PC

If a wallet file or seed phrase was ever on the PC, assume it is known. Make a new wallet and a new recovery phrase on a clean device and move the funds.

4 Run Microsoft Defender Offline Microsoft says to open Windows Security > Virus & threat protection > Scan options , choose Microsoft Defender Offline scan and select Scan now . Save your work first: Windows signs you out and restarts, and the scan takes 15 minutes. If BitLocker is on, Microsoft says to suspend it first or the restart may ask for the recovery key. Results are in Protection history .

Run Microsoft Defender Offline

Microsoft says to open Windows Security > Virus & threat protection > Scan options , choose Microsoft Defender Offline scan and select Scan now . Save your work first: Windows signs you out and restarts, and the scan takes 15 minutes. If BitLocker is on, Microsoft says to suspend it first or the restart may ask for the recovery key. Results are in Protection history .

5 Remove what you can tie to the incident Uninstall programs you did not install in Settings > Apps > Installed apps , and switch off unknown entries in Startup . If you cannot tell what is related, do not guess: the safe answer is the reset below.

Remove what you can tie to the incident

Uninstall programs you did not install in Settings > Apps > Installed apps , and switch off unknown entries in Startup . If you cannot tell what is related, do not guess: the safe answer is the reset below.

6 Reset Windows if you are not sure Go to Settings > System > Recovery > Reset this PC . Keep my files removes apps and settings; Remove everything wipes the PC. For a PC that ran a stealer which can also download other programs, the full wipe is the answer that does not depend on finding every piece. Back up documents first.

Reset Windows if you are not sure

Go to Settings > System > Recovery > Reset this PC . Keep my files removes apps and settings; Remove everything wipes the PC. For a PC that ran a stealer which can also download other programs, the full wipe is the answer that does not depend on finding every piece. Back up documents first.

7 Restore only documents by hand Copy back documents and photos, not programs and not a full system image made after the first . Install apps from their makers' own sites.

Restore only documents by hand

Copy back documents and photos, not programs and not a full system image made after the first . Install apps from their makers' own sites.

8 Do not let the browser save passwords again on a PC that was robbed Use a password manager and sign in again, one account at a time.

Do not let the browser save passwords again on a PC that was robbed

Use a password manager and sign in again, one account at a time.

9 Watch your money and accounts Check card statements and exchange logs for several weeks, turn on alerts and ask your bank a new card if card data was saved in the browser. If personal data was taken, report it to the consumer agency in your country.

Watch your money and accounts

Check card statements and exchange logs for several weeks, turn on alerts and ask your bank a new card if card data was saved in the browser. If personal data was taken, report it to the consumer agency in your country.

Keep a PC out of this kind of chain

A stealer needs you to run something. Most of what stops it is a habit, not a tool.

Treat any page that tells you to press Windows key plus R and paste a command as an attack, and close it. No genuine error page asks for that.

Get programs from their makers' own sites or the Microsoft Store.

Keep Windows and Microsoft Defender updated.

Use a password manager and an app or key for two step sign in.

Keep large crypto holdings in a hardware wallet that is not attached to the PC you browse on.

Do not paste commands from a web page into Windows, Run or PowerShell.

Do not run files from fake download pages or cracked software sites.

Do not store seed phrases in files or notes on the PC.

Do not let the browser hold every password for you on a shared or risky PC.

Do not rely on a quiet scan to say you are safe.

Questions Stealc stealer

Stealc is an information stealer for Windows, a malicious program that copies saved passwords, browser data, crypto wallets and other items and sends them to a criminal's server.

Malpedia records that it was first offered for sale on 9 January 2023 as a service, so buyers rent it rather than write it. Version 2 followed in March 2025. It is not a program anyone installs on purpose, and it has no legitimate use.

It is malware, and people often call it a virus, but the exact word is infostealer or trojan. Unlike a classic virus it does not copy itself to other files.

It runs once, gathers data and sends it out. Malpedia calls it non resident, which means it does not plan to stay. Zscaler lists persistence as absent in both versions, though programs it downloads may stay.

What does Stealc steal?

Malpedia names web browser data, browser extensions, desktop crypto wallets, messengers and email clients. Zscaler says version 2 adds a unified file grabber, screenshots of several monitors and server side guessing of passwords. What one infection took depends on the buyer's settings, so assume the worst case:

every wallet on that PC

How did Stealc get onto my PC?

It needs you to run something. Reports describe ClickFix pages, which show a fake error and tell you to paste a command into Windows, including fake CAPTCHA pages on hacked sites and fake Google Meet pages that Sekoia analysed.

We found no vendor report tying it to cracked software specifically. If you cannot recall any of these, run the checks on this page and treat the answer as unknown.

I saw Stealc in a Defender alert. What do I do?

Open Windows Security, Virus and threat protection, Protection history, and read the entry:

the time and whether it was blocked

A blocked file may never have run. If the file was started, or you are not sure, change your passwords and sign out all sessions from another device, then run a Microsoft Defender Offline scan.

How do I remove Stealc from Windows?

First change passwords and end sessions from another device, because the data is already gone. Then run Microsoft Defender Offline under Windows Security, Virus and threat protection, Scan options, remove apps you did not install, and check Startup.

If you cannot explain what ran, use Settings, System, Recovery, Reset this PC with Remove everything. We followed Microsoft's pages and did not test the steps on an infected PC.

Is it enough to change my passwords?

No, not alone. Stealers take session cookies as well, and a stolen session can keep working after the password is changed until the service ends it.

Use each service's option to sign out of all devices, then change the password, then turn on two step sign in with an app or a key. Do all of it from a device that is clean.

Does Stealc affect Mac, iPhone or Android?

We found nothing that says so. Malpedia and Zscaler describe a Windows program written in C that uses Windows system calls. The Sekoia ClickFix campaign had a macOS branch that used different malware.

On a phone or Mac there is nothing to remove for Stealc, but if you typed passwords on an infected Windows PC, change them.

Is Stealc still active in 2026?

Reports suggest yes, with doubt. Malpedia lists a Europol note and a Bitsight note from June 2026 Stealc and Amadey becoming unavailable in a coordinated action, which we did not read.

The abuse.ch ThreatFox radar still shows 12 entries for the name, the newest dated 21 October 2026. We cannot tell what those entries point to, so treat the family as still seen.

Will Fortect remove Stealc stealer?

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For Stealc stealer, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.

Malpedia: Stealc (win.stealc), Fraunhofer FKIE ( read October 25, 2026 )

Zscaler ThreatLabz: I StealC You, Tracking the Rapid Changes To StealC (1 May 2025) ( read October 25, 2026 )

Kowatek: Fake Google Meet Pages Deliver Infostealers in Ongoing ClickFix Campaign (18 October 2024, summary of Sekoia research) ( read October 25, 2026 )

CyberInsider: ClickFix tactics fuel malware campaigns across Windows and macOS ( read October 25, 2026 )

Microsoft Learn: Microsoft Defender Offline scan in Windows (updated 25 August 2026) ( read October 25, 2026 )