StealcMalware
Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.From MISP Galaxy
Last reported 1 month ago, by Seqrite Labs8 reports
ATT&CK techniques
6 of 71 · each with the sentence it comes from- T1684Social Engineering
“MacSync is delivered primarily through ClickFix social engineering and search engine malvertising.”
- T1036Masquerading
“Masquerading”
- T1195Supply Chain Compromise
“Cloud takeover, source-code theft, supply-chain compromise”
- T1027Obfuscated Files or Information
“T1027”
- T1071.001Web Protocols
“T1071.001”
- T1082System Information Discovery
“T1082”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures“By checking the browser User-Agent, the TDS redirects Windows visitors to chains distributing LummaC2, Stealc, or Vidar, while sending macOS visitors to MacSync ClickFix infection funnels.”
-
H1 2026 Malware Vulnerability Trends“AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS RAT remained in the top ten across H1 2025 and H1 2026.”
-
ESET participa en la Operación Endgame para interrumpir la botnet Amadey y el infostealer Stealc“ESET participa en la Operación Endgame para interrumpir la botnet Amadey y el infostealer Stealc”
-
ESET takes part in Operation Endgame to disrupt Amadey and Stealc“ESET takes part in Operation Endgame to disrupt Amadey and Stealc”
-
ErrTraffic: A Growing ClickFix Malware Distribution Framework“This cluster distributes several malware families, including infostealers such as Vidar, Stealc, Remus and Salat.”
-
ClearFake's Variant: Web3 Exploitation for Malware Delivery“These loaders subsequently deployed infostealers, such as Lumma and Stealc.”
-
ClickFix tactic: The Phantom Meet Infostealer Campaign“The analysed cluster uses fake Google Meet pages to deliver Stealc, Rhadamanthys and, on macOS, AMOS Stealer.”
-
ClickFix Removes Your Background but Leaves the Malware“Lumma and Stealc both adopted this pattern over the last year, and it's becoming standard for the commodity stealers.”
Indicators in its reports
named in the reports above- flare[.]ioin 3 reports
- 11a42ef076686cb2…943652a5aadcin 2 reports
- 32d0c3300825b0bb…44f0ad2da989in 2 reports
- 5f3f99b14243404c…1244cce394bfin 2 reports
- b4101027bf2f1261…b016ce249037in 2 reports
- f61e3a643f2417e1…fc8a7cb96756in 2 reports
- 09002d4668a77885…e421c0628357in 2 reports
Copy these 7 indicators · defanged
Thanks — we review every report.