{
  "name": "StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them",
  "slug": "stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them",
  "description": "Infostealers remain among the most pervasive cybercrime threats, silently harvesting passwords, cookies, and session tokens that enable enterprise breaches. StealC is a malware-as-a-service infostealer written in C++ that collects credentials from browsers, cryptocurrency wallets, messaging applications, email clients, and gaming platforms while functioning as a secondary loader. Amadey operates as a modular backdoor loader active since 2018, delivering downstream payloads including StealC, Lumma Stealer, and ransomware through various backdoor commands. Both operate on commodity rental models where stolen credentials flow through underground markets to access brokers who resell enterprise access. On June 24, 2026, Microsoft's Digital Crimes Unit coordinated with Europol to disrupt over 200 malicious command-and-control domains supporting these operations, using AI-assisted analysis tools including Microsoft Copilot for binary analysis and configuration extraction.",
  "published": "2026-06-24T13:40:01.377000+00:00",
  "created_at": "2026-06-24T17:48:01.781000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-06-24T17:48:01.781000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "access broker",
    "amadey",
    "credential theft",
    "cybercrime",
    "infostealer",
    "lumma stealer",
    "malware-as-a-service",
    "raccoon",
    "redline",
    "session token",
    "stealc",
    "vidar"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "bbb4e01b-05f8-4a90-ad67-c9d2fdc22be8",
        "name": "1246c5b89ab668c1137f377507bc3e266a98e93248382aa026610ae1e764a497"
      },
      {
        "id": "44098068-fa7e-411e-a580-6f3fdda69c72",
        "name": "https://bartsen284.online/39d9612df78e45b5a4bb.php"
      },
      {
        "id": "b52cc2fa-d78b-4c38-bdc6-ceca52e5f5fc",
        "name": "polse.us"
      },
      {
        "id": "2036c91a-39b6-4e7c-9dfe-42b99a797563",
        "name": "b7d1f172ff3feafe65d47fd1cbe0cc249316371ae0e1cbe3a7c741c738b3353d"
      },
      {
        "id": "3d5340d2-4b7d-45cf-b46f-d62cdd80757f",
        "name": "rebustan.top"
      },
      {
        "id": "1431a7a3-bb62-49c3-8336-07b888d34e57",
        "name": "0215f734867bd71c57ff5c524d8cc670be5b4f1861b2c390cf46d18784a53624"
      },
      {
        "id": "36e49b5e-e872-407f-99a6-ebf98cb44a6e",
        "name": "http://bluescry.com/01f96fd710e905ca2326.php"
      },
      {
        "id": "f3cd4604-df8b-4622-bdc8-babc9fae719e",
        "name": "http://svclsc.com/ms/index.php"
      },
      {
        "id": "824c3399-c279-488e-8975-061110a20f20",
        "name": "neltron-geltron.shop"
      },
      {
        "id": "e342ecd2-b265-4883-b942-1ca30191c823",
        "name": "bluescry.com"
      },
      {
        "id": "0de01ff9-409e-4a98-8a0d-57f7914217ba",
        "name": "9383572a30ae5b76fadd0700fbd7a1aa7b05d0b6c8f9cdaef9b30a3e1f65d57d"
      },
      {
        "id": "570384c0-ee5b-4022-a114-884628d153c1",
        "name": "30cef3d3d956e83e2c50579cfbe57a49159cccbcc8b0b0422f27d55e1c401ad9"
      },
      {
        "id": "03d2a61b-4581-4424-a4bb-2b13edef5757",
        "name": "8f32456359f209a63adfd24b94235e1727382ac7f7bb7f2bcaf754e721925b64"
      },
      {
        "id": "28f50fdb-6112-4cde-9a28-ddc55a85bb2c",
        "name": "d43c988d6f9cb355497696b580621fb1bdb7b6ed6d90f97520ecf6da5a1a41ff"
      },
      {
        "id": "478a4e82-9023-4124-83ed-ff9533872a6e",
        "name": "http://polse.us/62ea47cac2534aa18f74.php"
      },
      {
        "id": "da4fcfdb-65f6-449e-8fff-758e54165693",
        "name": "spasopro.at"
      },
      {
        "id": "df64d744-44ed-4ee2-8ad1-e9921777d960",
        "name": "http://microsoft-telemetry.at/cvdfnaFJBmC0/index.php"
      },
      {
        "id": "6cd167c7-95b6-4605-96be-870a69fcb5a0",
        "name": "svclsc.com"
      },
      {
        "id": "c96c73f8-6e70-4bc7-9a3e-492f01c59c70",
        "name": "https://neltron-geltron.shop/e396586b99ee49d19cc3.php"
      },
      {
        "id": "fbc9fa8a-d4ae-49b0-9b34-f55586117397",
        "name": "99507f18c4e61fdb109805404bf6a79ea8ce2fddc590ce48d717e97516ab7e8d"
      },
      {
        "id": "a8e48260-fbf8-4866-9e48-5836695c83b5",
        "name": "http://cdntestconnect.com/ed54b97a570943999715.php"
      },
      {
        "id": "a2606b8b-01b4-40d6-b8d8-39fb47252a1a",
        "name": "microsoft-telemetry.at"
      },
      {
        "id": "095d2bdd-34c7-404b-8825-f461f8d2455d",
        "name": "http://roger99699.xyz/425f1faf4b214434b8a3.php"
      },
      {
        "id": "5df584d0-85f9-4b8c-928d-4cbcc104760c",
        "name": "43455f1ff4a623b783da670d052eb77eaaacb0c66a9f1e8508f802bf22e8129e"
      },
      {
        "id": "12c675a3-1dea-4d2d-a377-ca70e5f9083a",
        "name": "http://secure.controlpanel.asia/330311481fe14ab99814.php"
      },
      {
        "id": "afbde976-c01d-43e0-b126-f942c7e8001f",
        "name": "bartsen284.online"
      },
      {
        "id": "035e1e40-73fc-40f4-ad7e-1de07a4832ac",
        "name": "5f5b25b2e35d404034d0d60975cf1ffbc6f141761ec3f4f15d6f7c6213a056f6"
      },
      {
        "id": "a79c9db1-05d9-4c52-abf1-331bcfe44cd3",
        "name": "goodpanelforgoodjob.com"
      },
      {
        "id": "527a1769-e576-4dba-97f0-ff847fb6fd87",
        "name": "98e504cc7125b79eda5491f40b998605a05f4cd968b961aab4cce7beb074fefe"
      },
      {
        "id": "673949b6-cdaf-41e2-85e5-f6efbbbbd338",
        "name": "ca4d4c4fc3e5d5cfa922b898f2d7411f03a446dddb139ba45dfd4f8f0018b64f"
      },
      {
        "id": "46eb2309-cac0-4f3f-b06c-cd37169ecc9c",
        "name": "cdntestconnect.com"
      },
      {
        "id": "542a6012-c1a9-4760-b6e2-281248b26e06",
        "name": "http://rebustan.top/gd7djkDveE2/index.php"
      },
      {
        "id": "00ad26f9-cb15-4002-8c0b-76a0902715f7",
        "name": "977b33a9b481cf714946b7d386865cd5d284312aa5ecfa0546c197b1003e1bde"
      },
      {
        "id": "1f5e3549-2402-4927-b212-af267f80840b",
        "name": "http://spasopro.at/Lsge63sd3/index.php"
      },
      {
        "id": "86a474e0-1a9e-4293-9edf-7c7a56de026e",
        "name": "roger99699.xyz"
      },
      {
        "id": "df944303-c100-4b83-97cb-7bb5af6a9ff3",
        "name": "http://goodpanelforgoodjob.com/hg8jjfSr5hy/index.php"
      },
      {
        "id": "f2fc2235-d3fa-48cb-a82a-2b5f0db33511",
        "name": "secure.controlpanel.asia"
      },
      {
        "id": "563b8831-a0f7-4cde-931b-698e40f0d794",
        "name": "8cef760d11d24fc2e9bbd9f770dca5105854f7ece3b0e6948d7c8b7fdd1765ea"
      },
      {
        "id": "bc5e0dd7-8b1e-4eab-a947-14da10c23401",
        "name": "2a0f053855da59b3b56812e580d7baeba59fc9493694722aa9e3f121ee3363f1"
      }
    ],
    "attack_patterns": [
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "b7ba0db0-7d4f-436f-8d5f-c431d690b048",
        "name": "T1555.003"
      },
      {
        "id": "4f0fd880-1731-42a7-88ed-97bb3c1c1571",
        "name": "T1136.001"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "f6ceeba2-b50c-47dc-8642-ab9842ca76d7",
        "name": "T1018"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "b7c6c1ad-f183-4128-8427-3891029c73dc",
        "name": "T1539"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "14660ccf-ca6b-42f6-8bca-e1b7a04650b3",
        "name": "T1573.001"
      },
      {
        "id": "b15c00da-c412-4429-900c-659de612baf5",
        "name": "T1543.003"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "195d9773-4de3-4f61-b94d-a2b53cb65608",
        "name": "T1021.001"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "malware": [
      {
        "id": "f3e275ca-9e84-4de9-9406-2603517cefb5",
        "name": "Raccoon",
        "slug": "raccoon"
      },
      {
        "id": "3b14bdfd-fdea-4534-96f8-2a0bd99b3833",
        "name": "Amadey - S1025",
        "slug": "amadey-s1025"
      },
      {
        "id": "54a0b340-b33e-4644-8a5a-68eea8cca00d",
        "name": "Stealc",
        "slug": "stealc"
      },
      {
        "id": "2c582ed8-35df-4ef9-917d-994e214aa5f9",
        "name": "Vidar",
        "slug": "vidar"
      },
      {
        "id": "9f5ac497-cb00-4732-9d01-49a96069bc30",
        "name": "RedLine",
        "slug": "redline"
      },
      {
        "id": "0051da15-675b-4665-a6d1-872f64cf47ea",
        "name": "Lumma Stealer",
        "slug": "lumma-stealer"
      }
    ],
    "observables": [
      {
        "id": "e5e49ad4-4e71-4661-a732-f4a5f87a336b",
        "name": "roger99699.xyz"
      },
      {
        "id": "61754ca4-2da9-4a6f-a416-b00a52a117a0",
        "name": "bluescry.com"
      },
      {
        "id": "10eded6a-7cf1-44a3-8a1a-3f188f86d283",
        "name": "goodpanelforgoodjob.com"
      },
      {
        "id": "dc15c439-7977-46f7-ac1a-512881429cab",
        "name": "polse.us"
      },
      {
        "id": "bdddd675-099a-47df-beaf-41eed79b35ed",
        "name": "microsoft-telemetry.at"
      },
      {
        "id": "c4df3105-cb3b-4122-85e7-dc6efea0c9ca",
        "name": "neltron-geltron.shop"
      },
      {
        "id": "d22d7f0f-b391-470e-91c9-7f2711e12907",
        "name": "spasopro.at"
      },
      {
        "id": "206f3442-59de-4fb5-ac2d-321460f2bb2a",
        "name": "cdntestconnect.com"
      },
      {
        "id": "6b9d6a52-64cb-496a-b5cd-4f76ddb9064c",
        "name": "bartsen284.online"
      },
      {
        "id": "35de0b7a-b804-4ce9-9d13-ffda33c33491",
        "name": "rebustan.top"
      },
      {
        "id": "98497054-83b0-4a95-8ac2-aa76eb09d9c6",
        "name": "svclsc.com"
      },
      {
        "id": "da5ecf78-7f44-471b-8dd6-26f353823fc3",
        "name": "secure.controlpanel.asia"
      },
      {
        "id": "aab9ca28-51b0-4fb3-895e-15f1804f57af",
        "name": "http://goodpanelforgoodjob.com/hg8jjfSr5hy/index.php"
      },
      {
        "id": "75cf909d-a60f-423c-b42a-7e8ef273311f",
        "name": "http://svclsc.com/ms/index.php"
      },
      {
        "id": "3b847ad3-5c8f-4126-8914-69235aa1b9f0",
        "name": "http://microsoft-telemetry.at/cvdfnaFJBmC0/index.php"
      },
      {
        "id": "6d3fd5a3-700f-4177-a684-586e6f60663a",
        "name": "http://spasopro.at/Lsge63sd3/index.php"
      },
      {
        "id": "57be1534-2ef9-456c-a353-e6cb65c3a037",
        "name": "http://roger99699.xyz/425f1faf4b214434b8a3.php"
      },
      {
        "id": "388489cb-a146-4fe3-b921-ce2a485d6206",
        "name": "http://rebustan.top/gd7djkDveE2/index.php"
      },
      {
        "id": "92a6b9a5-2289-41bc-8600-208beda95ddd",
        "name": "https://neltron-geltron.shop/e396586b99ee49d19cc3.php"
      },
      {
        "id": "11a19526-537e-40fa-824b-f9af2fb6bbc2",
        "name": "http://cdntestconnect.com/ed54b97a570943999715.php"
      },
      {
        "id": "964bf28b-4d81-4848-8bbf-a06cf62becf0",
        "name": "https://bartsen284.online/39d9612df78e45b5a4bb.php"
      },
      {
        "id": "006cc6a4-87c7-4bd6-aed6-5382d995fe87",
        "name": "http://secure.controlpanel.asia/330311481fe14ab99814.php"
      },
      {
        "id": "e2e392ef-876a-4f84-b232-d6cd9575eee5",
        "name": "http://bluescry.com/01f96fd710e905ca2326.php"
      },
      {
        "id": "3589a6b6-1cdb-49d3-9cf1-509618bd4544",
        "name": "http://polse.us/62ea47cac2534aa18f74.php"
      }
    ]
  },
  "external_refs": [
    {
      "id": "01255fdc-af47-44dd-a389-11ff602c5d11",
      "standard_id": "external-reference--5768c7ef-ba26-5d70-bc71-58404afcd333",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/",
      "hash": null,
      "external_id": null,
      "created": "2026-06-24T17:47:53.207Z",
      "modified": "2026-06-24T17:47:53.207Z",
      "createdById": null
    },
    {
      "id": "42535a52-8aac-4e37-9914-e7125a84a0de",
      "standard_id": "external-reference--58e2722b-23d2-5e81-a092-991439060f53",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a3bde31cd05f010063a2224",
      "hash": null,
      "external_id": "6a3bde31cd05f010063a2224",
      "created": "2026-06-24T17:47:53.174Z",
      "modified": "2026-06-24T17:47:53.174Z",
      "createdById": null
    }
  ]
}