StealC Malware Revives as Stadia RAT with Enhanced Capabilities

• •Stadia RAT combines credential theft with remote desktop control features.
• •The malware targets a wide range of applications, including over 50 browsers and 120 crypto extensions.
• •Stadia is offered on a subscription basis, with former StealC customers receiving incentives.

Following the takedown of StealC by Europol in June 2026, its seller has re-emerged with a new remote access trojan (RAT) named Stadia. This RAT combines credential theft with remote desktop control and command execution, utilizing code from StealC v3.5. Stadia was advertised on October 16, 2026, and features six modules, including a stealer, hidden virtual network computing (HVNC), and a file explorer. The malware targets over 50 browsers and 120 cryptocurrency extensions, with a subscription model ranging from $300 to $900 per month. Varonis Threat Labs confirmed the reuse of StealC code in Stadia and provided insights into its operation, including self-installation techniques and evasion measures against detection. The malware's infrastructure was rebuilt post-Operation Endgame, indicating a significant threat to users globally, particularly in South and Southeast Asia, Africa, and Latin America.