StealC Malware Panel Security Bug Exposed Threat Actor Operations

CyberArk researchers uncovered a cross-site scripting (XSS) vulnerability in the StealC malware control panel, ironically allowing defenders to spy on the very infrastructure designed for cookie theft and credential harvesting.

Key Findings

• XSS flaw: Allowed researchers to inject JavaScript into the StealC panel.
• Impact:
  • Collected system fingerprints of operators.
  • Monitored active sessions.
  • Stole cookies from StealC’s own infrastructure.
• Irony: Despite being built to steal cookies, StealC’s panel lacked basic protections like httpOnly, leaving its own session cookies exposed.

Background on StealC

• First seen: January 2023, offered as Malware-as-a-Service (MaaS).
• Distribution methods:
  • YouTube Ghost Network – disguised as cracked software.
  • Rogue Blender Foundation files.
  • FileFix social engineering lures.
  • Fake CAPTCHA campaigns (ClickFix-like).
• StealC V2: Added Telegram bot integration, enhanced payload delivery, and redesigned panel.
• Panel leak: Source code leak enabled researchers to analyze operator environments and session data.

Threat Actor Profile – YouTubeTA

• Used YouTube to spread cracked Adobe Photoshop/After Effects.
• Logs: 5,000+ entries, containing 390,000 stolen passwords and 30M cookies (mostly tracking cookies).
• Panel analysis:
  • One admin user.
  • Apple M3 processor.
  • English + Russian language settings.
• OpSec failure: In July 2025, forgot to use VPN → exposed real IP tied to TRK Cable TV (Ukraine).
• Assessment: Likely a lone-wolf actor in Eastern Europe.

Broader Implications

• MaaS ecosystem risks: While enabling rapid scaling of attacks, it also exposes operators to the same vulnerabilities legitimate businesses face.
• Law enforcement opportunity: Similar flaws in other malware panels could be exploited to deanonymize operators and gather intelligence.
• Operational irony: Criminals who weaponize weak security often fail to secure their own tools, creating exploitable gaps.

Takeaway

The StealC case highlights how security flaws in criminal infrastructure can be turned against threat actors. By exploiting a simple XSS bug, researchers gained visibility into attacker operations, underscoring the importance of secure coding—even for malicious platforms.