Stealc infostealer: how it works and how to protect your data

Stealc malware is an information stealer advertised on darknet forums that quietly collects passwords, browser data and crypto wallets from Windows computers. Here is how it works and how to protect yourself, including where Hide Expert VPN fits in.

What is Stealc?

In early 2023, researchers at the threat intelligence company Sekoia reported a new information stealer called Stealc. It was developed by a threat actor known as Plymouth and first advertised in January 2023 on hacker forums, where a free preview version quickly spread.

Stealc is sold as a service. Plymouth set up a Telegram channel with weekly change logs for new versions and gave customers access to an administration panel where they can easily build new Stealc samples. It is a typical product of the dark side of the internet, and it lets less experienced criminals run large-scale attacks that once required real skill.

How Stealc malware works

Sekoia found that Stealc shares many traits with older stealers such as Vidar, Raccoon, Mars and Redline, which are known for taking web browser data, crypto wallet extensions and information from apps like email clients and messengers. Unlike ransomware, it does not lock your files – it quietly copies data and sends it away. After analyzing a captured sample, the researchers reported that Stealc:

• is lightweight, at only about 80 KB;
• is written in C and abuses Windows API functions;
• uses legitimate third-party DLLs;
• hides most of its text strings with RC4 encryption and base64 encoding;
• targets 22 web browsers, 75 plugins and 25 desktop crypto wallets;
• sends stolen data to the attackers automatically.

One feature stood out: a customizable file grabber that lets the operator choose specific files to steal on top of the standard haul. Plymouth also kept adding features after the first version.

What an infostealer takes from you

Browsers store a lot of sensitive information: saved passwords, autofill data, card details, browsing history and session cookies. Session cookies are especially valuable because they can let an attacker open your accounts without knowing the password. Wallet extensions and desktop wallets are another prime target, since stolen crypto is very hard to recover.

Stolen data is usually bundled into logs that criminals sell or use for account takeover and fraud. If your details end up in such a log, having a plan for dealing with identity theft helps you act fast and limit the damage.

How Stealc and similar stealers spread

Information stealers like Stealc usually reach victims through a few familiar routes:

• fake or cracked versions of popular software and games;
• malicious ads and search results that lead to lookalike download sites;
• phishing emails with infected attachments;
• malicious browser extensions and fake update prompts.

Who is at risk

Anyone using Windows can become a target, but some people are more exposed: those who download software from unofficial sources, people who keep many passwords saved in the browser, crypto holders using browser or desktop wallets, and employees whose work accounts open the door to company systems.

How to protect yourself from Stealc and similar stealers

1. Download software only from official sources. Avoid cracked programs, key generators and unofficial mirrors – they are a common way to deliver stealers.
2. Keep Windows, browsers and security tools updated. Sekoia advised companies and individuals to keep their security systems up to date, and the built-in Windows Security protection should stay switched on.
3. Use a dedicated password manager with a strong master password, and turn on two-factor authentication or passkeys wherever possible.
4. Protect your crypto. Keep larger amounts in a hardware wallet, and never store seed phrases in text files, screenshots or notes on your computer.
5. Handle downloads with care. Scan files before opening them and delete installers you no longer need – these tips on securing downloaded files help.
6. Review active sessions. In your important accounts, sign out of devices you no longer use.

On public Wi-Fi, Hide Expert VPN encrypts your traffic so others on the same network cannot read it. It cannot stop a stealer that you install yourself, though, so careful downloading remains your main defense.

What to do if you think you are infected

Disconnect the computer from the internet, run a full scan with up-to-date security software, and if in doubt, back up your documents and reinstall Windows. Then, from a clean device, change your passwords, sign out of all active sessions and move any crypto to a new wallet with a new seed phrase. Watch your bank and card statements for unusual activity.

Conclusion

Stealc shows how cheap and accessible data theft has become: a small, well-hidden program sold as a service can collect browser data and wallets and send them straight to attackers. Careful downloads, regular updates, a password manager and a quick response if something goes wrong keep that risk under control.