{"id":9949,"date":"2026-01-17T10:04:17","date_gmt":"2026-01-17T10:04:17","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/17\/researchers-gain-access-to-stealc-malware-command-and-control-systems\/"},"modified":"2026-01-17T10:04:17","modified_gmt":"2026-01-17T10:04:17","slug":"researchers-gain-access-to-stealc-malware-command-and-control-systems","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/17\/researchers-gain-access-to-stealc-malware-command-and-control-systems\/","title":{"rendered":"Researchers Gain Access to StealC Malware Command-and-Control Systems"},"content":{"rendered":"

Researchers Gain Access to StealC Malware Command-and-Control Systems
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Security researchers successfully exploited vulnerabilities in the StealC malware infrastructure, gaining access to operator control panels and exposing a threat actor\u2019s identity through their own stolen session cookies<\/a>. <\/p>\n

The breach highlights critical security failures in criminal operations built around credential theft.<\/p>\n

XSS Vulnerability Exposes StealC Operators<\/strong><\/h2>\n

StealC, an information-stealing malware operating under a Malware-as-a-Service<\/a> model since early 2023, faced a significant setback when researchers discovered a cross-site scripting (XSS) vulnerability in its web panel following a code leak in spring 2025. <\/p>\n

\"StealC
StealC build page with example build called \u201cYouTubeNew\u201d<\/figcaption><\/figure>\n

By exploiting this flaw, CyberArk Labs collected system fingerprints, monitored active sessions, and captured authentication cookies from the infrastructure designed to steal them. <\/p>\n

The irony proved significant: operators specializing in cookie theft failed to implement basic security features, such as the httpOnly flag, that would have prevented cookie hijacking via XSS attacks.<\/p>\n

\"
\u00a0YouTubeTA\u2019s StealC web panel<\/figcaption><\/figure>\n

Through panel access, researchers tracked a single operator designated \u201cYouTubeTA\u201d (YouTube Threat Actor) who maintained over 5,000 infection logs containing 390,000 stolen passwords and 30 million cookies. <\/p>\n

Screenshots captured by the malware showed victims searching for cracked versions of Adobe Photoshop<\/a> and After Effects on YouTube, suggesting that YouTubeTA compromised legitimate YouTube channels with established subscriber bases to distribute StealC. <\/p>\n

\n
\"Likely
Likely clickfix page used to install StealC<\/figcaption><\/figure>\n<\/div>\n

The operator\u2019s panel configuration included specific markers for studio.youtube.com credentials, indicating a strategy to hijack content creator accounts and expand malware distribution networks.<\/p>\n

Panel fingerprinting identified YouTubeTA as a single operator using an Apple M3 processor, with consistent hardware signatures across all sessions, as reported <\/a>by CyberArk Labs . <\/p>\n

Language preferences showed support for English and Russian, while timezone data indicated GMT+0300 (Eastern European Summer Time). <\/p>\n

A critical operational security failure occurred when the operator briefly connected without VPN protection, revealing an IP address associated with Ukrainian ISP TRK Cable TV. <\/p>\n

This breach demonstrates how MaaS supply chain vulnerabilities expose both infrastructure weaknesses and operator identities to security researchers.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post Researchers Gain Access to StealC Malware Command-and-Control Systems<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Dhivya
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Researchers Gain Access to StealC Malware Command-and-Control Systems Security researchers successfully exploited vulnerabilities in the StealC malware infrastructure, gaining access to operator control panels and exposing a threat actor\u2019s identity through their own stolen session cookies. The breach highlights critical security failures in criminal operations built around credential theft. XSS Vulnerability Exposes StealC Operators StealC, […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,258],"tags":[130],"class_list":["post-9949","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-malware","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9949"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9949"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9949\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9949"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9949"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9949"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}