StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them

1. Executive summary

On 2026-06-24, Microsoft's Digital Crimes Unit (DCU), working with Europol and industry partners, announced a coordinated disruption action against the StealC infostealer and the Amadey MaaS loader. Over 200 malicious C2 domains and IPs were taken down via court orders, domain seizures, and provider notifications; approximately 27 million stolen credentials were recovered and over $47 million in cryptocurrency assets were restricted. Amadey and StealC were linked to more than 140,000 infected computers globally in the first two weeks of May 2026 alone. For EMEA financial services, the primary risk is credential and session-token theft from unmanaged or lightly managed employee devices (e.g., home PCs), which can yield corporate VPN, SSO, and email credentials that bypass MFA and enable downstream ransomware, fraud, and account takeover.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed steps)

1. Initial delivery. Amadey and StealC are delivered via SEO poisoning, malicious advertising, trojanized/cracked software, the ClickFix technique (tricking users into pasting a command into the Windows Run dialog or terminal), phishing email, or delivery by other malware (e.g., Amadey loader deploying StealC).
2. Amadey execution. Upon execution, Amadey copies itself to nudwee.exe in a target directory (system-dependent), executes the copy, and creates a scheduled task for persistence.
3. Amadey C2 registration. Amadey sends a status check (st=s) via HTTP POST to its C2, receives a sleep multiplier, then sends an RC4-encrypted and hex-encoded victim fingerprint (fields: id, vs [version, e.g., "5.34"], sd, os, bi, ar, pc, un, dm, av, lv, og).
4. Amadey backdoor operation. C2 issues backdoor commands (0x0A–0x1D). Capabilities include: downloading and executing EXE/DLL/MSI/PS1 payloads, process injection, SOCKS proxy relay, screenshot capture and exfiltration, credential theft (via cred.dll plugin loaded through rundll32.exe cred.dll, Main), clipboard theft (via clip.dll plugin), VNC/remote access, enabling RDP (setting fDenyTSConnections=0, configuring firewall and Terminal Services auto-start), creating a hidden local admin account, self-update, and self-uninstall (removes scheduled task, writes RunOnce registry key to execute cmd /C RMDIR /s/q C:\Users\<user name>\e079729711).
5. StealC deployment. Amadey downloads and executes StealC (e.g., via Drop EXE, Download and inject, or Drop EXE elevated commands). In a December 2025 incident reported by Trellix, Amadey retrieved StealC from a compromised self-hosted GitLab instance rather than public hosting, to make delivery infrastructure appear more legitimate with valid TLS certificates.
6. StealC execution and anti-analysis. StealC (written in C++) creates a Windows event named <computer_name>_<username> as a mutex/victim ID. If the event already exists, it enters a polling loop (<5-second intervals) to avoid multiple instances. It checks an embedded expiration date and terminates if expired. It queries the system's default language and terminates if the locale matches Russian, Ukrainian, Belarusian, Kazakh, or Uzbek.
7. StealC C2 registration. StealC sends an RC4-encrypted, Base64-encoded HTTP POST registration request to its C2 panel. If registration fails, the malware self-terminates. The C2 responds with a JSON configuration object containing an access token and module configuration.
8. Data collection (StealC). StealC performs comprehensive collection: - Chromium browsers (Chrome, Edge, Brave, Opera, Vivaldi, others): resolves profile directory under %APPDATA% or %LOCALAPPDATA%, targets browser data stores. To defeat Chromium's App-Bound Encryption (ABE), StealC injects an embedded payload (~165 KB) into a sacrificial suspended process via APC. The injected module performs in-process decryption and writes cleartext to C:\ProgramData\<HWID>.txt. StealC reads back up to 511 bytes, processes the result, and deletes the temporary file. Retries up to three times. Decrypted credentials are formatted as plaintext (URL, login, password) and exfiltrated. - Firefox/Gecko browsers (Firefox, Thunderbird, Waterfox, others): locates profiles.ini to identify active profiles, extracts data from Gecko-specific data stores. - Microsoft Outlook: enumerates profiles from HKCU\Software\Microsoft\Office\<version>\Outlook\Profiles and HKCU\Software\Microsoft\Windows Messaging Subsystem\Profiles. Reads account values (server settings, usernames) and recovers saved passwords from encrypted storage. Exfiltrates IMAP, POP3, and SMTP credentials. - Foxmail: locates Foxmail data directory, parses account storage files (Accounts records under each account's Storage folder), extracts email addresses, server details, and saved passwords, decrypting Foxmail's proprietary password encoding. - WinSCP: collects saved session credentials from HKCU\Software\Martin Prikryl\WinSCP 2\Sessions or, for portable storage, the WinSCP.ini file. Recovers hostname, username, and password, reversing WinSCP's custom password obfuscation. - File grabber: processes C2-supplied rules specifying target directory, file mask patterns, recursion depth, and optional size limits. Uses recursive directory enumeration, copies selected files to a staging directory under C:\ProgramData, reads into memory for exfiltration, then deletes the temporary copy. - Steam: if C2-enabled, retrieves Steam path from HKCU\SOFTWARE\Valve\Steam, navigates to configuration subdirectory, and collects configuration files. - Screenshot: if C2-enabled, captures a full desktop screenshot. - Cryptocurrency wallets, messaging applications, gaming platforms: targeted as part of comprehensive collection.
9. Secondary loader capability (StealC). After data collection, StealC contacts C2 with request type loader, authenticating with the received access token. C2 responds with a list of payloads to download and execute. Three execution methods are supported (specific methods not enumerated in source). Supported payload types: .exe, .msi, and PowerShell scripts.
10. Exfiltration and cleanup. All stolen data (system information, browser credentials, grabbed files, screenshots) is transmitted in individual POST requests, each RC4-encrypted and Base64-encoded. StealC sends a final done notification to C2 with the access token. If the self-delete flag is set in C2 configuration, the malware removes itself from disk as its final operation (specific command not fully enumerated in source).

Amadey geofencing

Amadey queries the system registry for keyboard layout IDs (specific IDs not enumerated in source). An internal flag is set based on these checks, which is used to skip certain functionalities (credential stealing, clipboard stealing) for specific locales.

Confidence caveats

• Attribution of specific threat actors to StealC and Amadey is unconfirmed — no MITRE profiles are available in the verified reference data. Microsoft's civil complaint names five defendants allegedly involved across both operations, but no named actor has a confirmed MITRE profile.
• The December 2025 GitLab delivery vector is single-sourced (Trellix research, referenced in the Microsoft blog). Verify before enforcement.
• The figure of 140,000 infected computers in the first two weeks of May 2026 is attributed to Microsoft; the figure of 27 million recovered credentials and $47 million in restricted cryptocurrency assets is attributed to Europol via The Register. These are single-sourced per outlet.

4. Mitigation & containment

P1 — Within 24 hours

1. Block all C2 domains and IPs at web proxies, firewalls, DNS sinkholes, and email security gateways. The full list of C2 URLs is in §5. Defang notation: replace hxxp with http and hxxps with https for rule creation.
2. Block the following file hashes in EDR/AV: - All StealC SHA-256 hashes (4 samples) - All Amadey SHA-256 hashes (13 samples, versions 5.60–5.87) - See §5 for exact values.
3. Hunt for Amadey persistence artefacts: - Scheduled tasks referencing nudwee.exe - File nudwee.exe in %APPDATA%, %TEMP%, %USERPROFILE%, or Desktop - Directory C:\Users\<username>\e079729711 - RunOnce registry key executing cmd /C RMDIR /s/q C:\Users\<username>\e079729711
4. Hunt for StealC artefacts: - File C:\ProgramData\<HWID>.txt (temporary ABE decryption output) - Files staged under C:\ProgramData (file grabber temporary copies) - Windows event named <computer_name>_<username>
5. Hunt for registry keys accessed by StealC: - HKCU\Software\Microsoft\Office\<version>\Outlook\Profiles - HKCU\Software\Microsoft\Windows Messaging Subsystem\Profiles - HKCU\Software\Martin Prikryl\WinSCP 2\Sessions - HKCU\SOFTWARE\Valve\Steam
6. Hunt for Amadey RDP enablement: - Registry: fDenyTSConnections=0 - Firewall rule changes enabling Remote Desktop - Terminal Services configured for auto-start
7. Hunt for hidden admin accounts created by Amadey (command 0x19): review new local user accounts added to the Administrators group with password expiration disabled.

P2 — Within 72 hours

1. Audit credential stores for compromise: rotate credentials for any accounts whose sessions or stored credentials may have been on any device where StealC or Amadey was detected. Prioritate: VPN, SSO, email (IMAP/POP3/SMTP), FTP/SFTP (WinSCP), and browser-stored credentials.
2. Invalidate and rotate session cookies/tokens for any identities that may have been on an infected device. Stolen session cookies can bypass MFA.
3. Review GitLab (self-hosted) instances for compromise or unauthorised access, given the December 2025 observation of Amadey retrieving StealC from a compromised self-hosted GitLab instance. Verify GitLab instance integrity, review access logs, and check for unauthorised project uploads.
4. Deploy Microsoft Defender detections (if applicable to your environment): - Trojan:Win32/Amadey, Trojan:Win64/Amadey, Trojan:MSIL/Amadey, Trojan:PowerShell/Amadey - Behavior:Win64/Amadey, Behavior:Win32/Amadey - TrojanDownloader:Win32/Amadey, TrojanDownloader:Win64/Amadey, TrojanDownloader:PowerShell/Amadey, TrojanDownloader:MSIL/Amadey - TrojanDownloader:Win64/Stealc, TrojanDownloader:VBS/StealC, TrojanDownloader:PowerShell/StealC, TrojanDownloader:MSIL/StealC - Trojan:Win64/Stealc, Trojan:Win32/Stealc, Trojan:MSIL/Stealc - Behavior:Win64/Stealc
5. Monitor for SOCKS proxy activity on endpoints (Amadey commands 0x0F/0x10) — unexpected outbound SOCKS relay traffic.

P3 — Within 7 days

1. Implement identity-protection controls: enforce conditional access policies that invalidate sessions from unmanaged devices; require device compliance for VPN and SSO access; implement session-token binding to device identity where supported.
2. Strengthen credential hygiene: prohibit credential storage in browsers on unmanaged devices; deploy managed password managers; enforce short session-token lifetimes for high-value applications.
3. Deploy EDR rules for: - Process injection into suspended processes via APC (StealC ABE bypass) - rundll32.exe loading cred.dll or clip.dll from non-standard paths (Amadey plugins) - Creation of C:\ProgramData\*.txt files by non-signed processes (StealC IPC) - PowerShell scripts downloaded and executed from external URLs (Amadey command 0x0E, StealC loader)
4. Review BYOD and remote-work policies: ensure that corporate credential use on personal devices is governed, monitored, and subject to security controls (e.g., browser isolation, managed profiles).
5. Threat-hunt for dormant credential abuse: review authentication logs for sign-ins using credentials that may have been stolen weeks or months earlier. Look for impossible travel, new device fingerprints, and sessions that bypass MFA via session cookies.

5. Indicators of compromise

sha256  8f32456359f209a63adfd24b94235e1727382ac7f7bb7f2bcaf754e721925b64
sha256  0215f734867bd71c57ff5c524d8cc670be5b4f1861b2c390cf46d18784a53624
sha256  2a0f053855da59b3b56812e580d7baeba59fc9493694722aa9e3f121ee3363f1
sha256  977b33a9b481cf714946b7d386865cd5d284312aa5ecfa0546c197b1003e1bde
sha256  b7d1f172ff3feafe65d47fd1cbe0cc249316371ae0e1cbe3a7c741c738b3353d
sha256  9383572a30ae5b76fadd0700fbd7a1aa7b05d0b6c8f9cdaef9b30a3e1f65d57d
sha256  5f5b25b2e35d404034d0d60975cf1ffbc6f141761ec3f4f15d6f7c6213a056f6
sha256  98e504cc7125b79eda5491f40b998605a05f4cd968b961aab4cce7beb074fefe
sha256  30cef3d3d956e83e2c50579cfbe57a49159cccbcc8b0b0422f27d55e1c401ad9
sha256  8cef760d11d24fc2e9bbd9f770dca5105854f7ece3b0e6948d7c8b7fdd1765ea
sha256  99507f18c4e61fdb109805404bf6a79ea8ce2fddc590ce48d717e97516ab7e8d
sha256  1246c5b89ab668c1137f377507bc3e266a98e93248382aa026610ae1e764a497
sha256  d43c988d6f9cb355497696b580621fb1bdb7b6ed6d90f97520ecf6da5a1a41ff
sha256  ca4d4c4fc3e5d5cfa922b898f2d7411f03a446dddb139ba45dfd4f8f0018b64f
sha256  43455f1ff4a623b783da670d052eb77eaaacb0c66a9f1e8508f802bf22e8129e
domain  polse.us
domain  roger99699.xyz
domain  bluescry.com
domain  secure.controlpanel.asia
domain  neltron-geltron.shop
domain  cdntestconnect.com
domain  bartsen284.online
domain  goodpanelforgoodjob.com
domain  rebustan.top
domain  svclsc.com
domain  microsoft-telemetry.at
domain  spasopro.at

6. Detection

YARA rule — StealC

rule StealC_Infostealer {
  meta:
    author = "Adverse Trace"
    date = "2026-06-25"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/"
    description = "Detects StealC infostealer based on C2 URLs, file paths, and behavioural strings from Microsoft DCU analysis"
  strings:
    $c2_1 = "polse.us" nocase
    $c2_2 = "roger99699.xyz" nocase
    $c2_3 = "bluescry.com" nocase
    $c2_4 = "secure.controlpanel.asia" nocase
    $c2_5 = "neltron-geltron.shop" nocase
    $c2_6 = "cdntestconnect.com" nocase
    $c2_7 = "bartsen284.online" nocase
    $path_1 = "C:\\ProgramData\\" ascii
    $reg_1 = "Software\\Martin Prikryl\\WinSCP 2\\Sessions" ascii
    $reg_2 = "Software\\Microsoft\\Office\\" ascii
    $reg_3 = "Outlook\\Profiles" ascii
    $reg_4 = "Software\\Microsoft\\Windows Messaging Subsystem\\Profiles" ascii
    $reg_5 = "SOFTWARE\\Valve\\Steam" ascii
    $file_1 = "profiles.ini" ascii
    $file_2 = "WinSCP.ini" ascii
    $file_3 = "nudwee.exe" ascii
    $ext_1 = ".txt" ascii
  condition:
    uint16(0) == 0x5A4D and (3 of ($c2_*) or (2 of ($c2_*) and 2 of ($reg_*)) or (1 of ($c2_*) and 3 of ($reg_*, $path_1, $file_*)))
}

YARA rule — Amadey

rule Amadey_Loader {
  meta:
    author = "Adverse Trace"
    date = "2026-06-25"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/"
    description = "Detects Amadey MaaS loader based on C2 URLs, persistence artefacts, and behavioural strings from Microsoft DCU analysis"
  strings:
    $c2_1 = "goodpanelforgoodjob.com" nocase
    $c2_2 = "rebustan.top" nocase
    $c2_3 = "svclsc.com" nocase
    $c2_4 = "microsoft-telemetry.at" nocase
    $c2_5 = "spasopro.at" nocase
    $file_1 = "nudwee.exe" ascii
    $dir_1 = "e079729711" ascii
    $cmd_1 = "RMDIR /s/q" ascii
    $dll_1 = "cred.dll" ascii
    $dll_2 = "clip.dll" ascii
    $proc_1 = "rundll32.exe" ascii
    $str_1 = "st=s" ascii
  condition:
    uint16(0) == 0x5A4D and (2 of ($c2_*) or (1 of ($c2_*) and 2 of ($file_1, $dir_1, $dll_*, $str_1)))
}

Sigma rule — Amadey persistence via scheduled task

title: Amadey Loader Persistence via Scheduled Task
id: 5a7c8e2d-3b1f-4a9e-8d2c-0f6e1a3b5c7d
status: experimental
description: Detects creation of a scheduled task referencing nudwee.exe, consistent with Amadey loader persistence
author: Adverse Trace
date: 2026/06/25
references:

  - https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/
logsource:
  product: windows
  service: security
detection:
  selection_schtask:
    EventID: 4698
    TaskName|contains:

      - "nudwee"
  selection_action:
    TaskContent|contains:

      - "nudwee.exe"
  condition: selection_schtask or selection_action
falsepositives:

  - Unknown
level: high
tags:

  - attack.persistence
  - attack.t1053

Sigma rule — StealC ABE bypass IPC file

title: StealC ABE Decryption IPC File Creation
id: 7b3d9f1c-2e5a-4c8f-9d1b-3e7a0c5f8b2d
status: experimental
description: Detects creation of C:\ProgramData\<HWID>.txt used by StealC for Chromium App-Bound Encryption bypass via inter-process communication
author: Adverse Trace
date: 2026/06/25
references:

  - https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/
logsource:
  product: windows
  service: security
detection:
  selection_file_create:
    EventID: 4663
    ObjectName|startswith: "C:\\ProgramData\\"
    ObjectName|endswith: ".txt"
  filter_legitimate:
    ProcessName|endswith:

      - "\\explorer.exe"
      - "\\searchindexer.exe"
  condition: selection_file_create and not filter_legitimate
falsepositives:

  - Legitimate applications writing .txt files to ProgramData
level: medium
tags:

  - attack.credential-access
  - attack.t1555

Sigma rule — Amadey hidden admin account creation

title: Amadey Hidden Admin Account Creation
id: 9c2e4f7a-1d3b-4e8c-9f2a-5b6c7d8e1f2a
status: experimental
description: Detects creation of a local user account followed by addition to Administrators group with password expiration disabled, consistent with Amadey backdoor command 0x19
author: Adverse Trace
date: 2026/06/25
references:

  - https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/
logsource:
  product: windows
  service: security
detection:
  selection_user_create:
    EventID: 4720
  selection_admin_add:
    EventID: 4732
  timeframe: 5m
  condition: selection_user_create | near selection_admin_add
falsepositives:

  - Legitimate administrator account creation
level: high
tags:

  - attack.persistence
  - attack.t1136

Sigma rule — Amadey RDP enablement

title: Amadey RDP Enablement via Registry and Firewall Changes
id: 1a3b5c7d-2e4f-4a9b-8c1d-3e5f7a9b2c4d
status: experimental
description: Detects registry change setting fDenyTSConnections=0 and firewall rule enabling Remote Desktop, consistent with Amadey backdoor command 0x18
author: Adverse Trace
date: 2026/06/25
references:

  - https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/
logsource:
  product: windows
  service: security
detection:
  selection_registry:
    EventID: 4657
    ObjectName|endswith: "fDenyTSConnections"
    NewValue: "0"
  selection_firewall:
    EventID: 4946
  condition: selection_registry or selection_firewall
falsepositives:

  - Legitimate RDP enablement by IT administration
level: medium
tags:

  - attack.persistence
  - attack.t1136

7. Sources

• Microsoft Security Blog — "StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them" — https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/ — 2026-06-24
• The Register Security — "Microsoft uses AI to link two malware operations in racketeering suit" — https://www.theregister.com/security/2026/06/24/microsoft-uses-ai-to-link-two-malware-operations-in-racketeering-suit/5261656 — 2026-06-24
• Cybersecurity Dive — "Microsoft, Europol lead global takedown of infostealer malware" — https://www.cybersecuritydive.com/news/microsoft-europol-international-takedown-infostealer-malware/823655/ — 2026-06-24
• SecurityWeek — "Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware" — https://www.securityweek.com/microsoft-and-allies-smash-shared-infrastructure-of-amadey-and-stealc-malware/ — 2026-06-24
• The Hacker News — "Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered" — https://thehackernews.com/2026/06/amadey-and-stealc-malware-network.html — 2026-06-24
• BleepingComputer — "Amadey, StealC malware operations disrupted in Operation Endgame action" — https://www.bleepingcomputer.com/news/security/amadey-stealc-malware-operations-disrupted-in-operation-endgame-action/ — 2026-06-24

8. Adverse Trace position

This is a high-severity threat for EMEA financial services. The disruption action on 2026-06-24 has degraded StealC and Amadey C2 infrastructure, but the malware families remain in active circulation, and stolen credentials already exfiltrated will continue to be monetised by access brokers for weeks to months. The core risk to financial institutions is not direct endpoint compromise but the downstream abuse of stolen corporate credentials (VPN, SSO, email, FTP/SFTP) that enable MFA bypass via session cookies, account takeover, fraud, and ransomware deployment. Attribution to specific named actors is unconfirmed — no MITRE profiles are available in the verified reference data; the five defendants named in Microsoft's civil complaint are not linked to confirmed MITRE-tracked actors. The December 2025 GitLab delivery vector is single-sourced (Trellix via Microsoft blog) — verify before incorporating into supply-chain controls. Adverse Trace will continue to monitor for reconstitution of StealC and Amadey C2 infrastructure, new sample variants, and any confirmed attribution to named threat actors. Clients should prioritise P1 actions immediately, with particular focus on blocking C2 domains, hunting for Amadey persistence artefacts, and rotating credentials for any identities that may have been on infected devices.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.