FHN 
A new malware service called Stadia RAT gives cybercriminals more than one way to compromise Windows computers. Alongside stealing sensitive information, it provides tools to access files, execute commands, and operate a hidden desktop without the user’s knowledge.
The service appeared on October 16, 2026, and has drawn attention from security researchers because of its technical links to the StealC information-stealing malware. Its emergence also highlights how cybercrime operations can continue even after law enforcement disrupts their infrastructure.
One Malware, Multiple Attack Capabilities
Stadia combines information theft and remote administration features in a single package. According to Varonis Threat Labs, its capabilities are divided into six modules that allow operators to perform different activities on compromised machines.
These include:
- Stealing credentials and other sensitive information from browsers and applications.
- Accessing a hidden desktop through Hidden Virtual Network Computing (HVNC).
- Running commands remotely on infected computers.
- Browsing, transferring, and executing files.
- Monitoring and managing active processes.
- Loading additional malicious software.
The malware seller claims support for numerous browsers, cryptocurrency extensions, desktop wallets, messaging applications, email clients, and VPN software.
Stadia is also sold through monthly plans priced at $300, $550, and $900. The highest-priced subscription includes all six modules, while former StealC customers have been offered a free month of the Pro plan.
Evidence Connects Stadia to StealC
Stadia appeared after Operation Endgame disrupted infrastructure associated with StealC and other cybercrime operations. Varonis reported that authorities seized 326 servers and 142 domains during the operation.
Researchers connected the newer malware to StealC after examining its code. One important finding was an identical browser encryption component shared with StealC version 3.5. This provides evidence that the newer service reuses technology from the earlier malware.
Stadia also uses techniques intended to avoid detection and maintain access, including:
- Creating scheduled tasks to launch automatically and run periodically.
- Using encrypted strings to make analysis more difficult.
- Injecting code into browser processes to obtain sensitive data.
- Adding its installation directory to Microsoft Defender exclusions when sufficient permissions are available.
- Sending encrypted information to remote servers over HTTP.
The examined sample also checks Windows language settings and may stop running on systems configured for certain languages.
Detection Requires More Than Blocking Known Indicators
Stadia’s infrastructure and encryption details may change between versions, making it difficult to rely solely on known file hashes, domains, or IP addresses.
Security teams should look for suspicious browser process activity, unexpected scheduled tasks, unauthorized antivirus exclusions, unusual PowerShell commands, and unexplained outbound network traffic.
Organizations should also strengthen credential protection, monitor endpoints for suspicious behavior, and investigate signs of unauthorized remote access.
Although researchers have identified technical links between Stadia and StealC, the initial infection method and the total number of affected systems remain unconfirmed. Monitoring the malware’s behavior is therefore essential to detecting potential attacks.
IoCs
| Type | Indicator | Context |
|---|---|---|
| Sample | stadia_x32.exe | Agent 1.1.2 |
| SHA-256 | ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e | Agent |
| SHA-1 | 1ba76d2029744cc6e2f7209c96a696b32962b1f1 | Same sample |
| MD5 | 7739a8d0d101ca82b93bbd0acdb6d9af | Same sample |
| Imphash | 028afae8b5e9953e1cd84a003c42fd85 | Outer executable |
| Helper SHA-256 | 0e5337a4cc8ebc772bc50f6e79befd1e8efad3410022e050d08d5269733c4ea4 | Shared StealC helper |
| Primary C2 | hxxp://93[.]152[.]213[.]215/ | HTTP POST |
| Secondary C2 | hxxp://91[.]92[.]43[.]45/ | Failover |
| Third C2 | hxxp://193[.]148[.]56[.]97/ | Failover |
| Panel domain | stadiadev[.]cc | Operator panel |
| RC4 string key | eepkTOgSwdNCgrhITR | Build-specific |
| Build marker | STADIA_BETA | Decrypted string |
| Desktop object | StadiaVnc%d | Session naming |
| Mutex | Local\<username>.<computername> | Single-instance guard |
| Installation | C:\ProgramData\<12 alphanumeric>\<name>.exe | Random directory |
| Candidate names | RuntimeBroker.exe, SecurityHealthHost.exe, SearchHost.exe, TextInputHost.exe, MicrosoftEdgeUpdate.exe, GoogleUpdate.exe, OneDriveStandaloneUpdater.exe, nvcontainer.exe, AdobeARM.exe | Installation/task disguises |
| Scheduled task | Hidden; PT15M; P3650D; InteractiveToken | COM-registered persistence |
| PowerShell | Add-MpPreference -ExclusionPath | Elevated exclusion creation |
| Temporary file | GUID-style .txt under C:\ProgramData\, containing 64 lowercase hexadecimal characters | Browser-key artifact |
| Seller | plymouth | Signs as stealc/stadia |
About the Author
