Stealc

StealC is a prominent malware that specifically targets browser extensions and password managers. It rose to infamy following an attack on the Solana blockchain in 2023, which resulted in a $7 million heist. This heist was orchestrated using Luca Stealer, another malware that targets crypto wallets and password managers. However, StealC sets itself apart by focusing on browser extensions and authenticators provided by password managers. The malware operates by injecting itself into explorer.exe, leading to the execution of multiple info stealers from the malware families Danabot and StealC. The StealC malware communicates with different Command and Control (C2) servers, such as 46.8.238.240 and 23.94.225.177. This communication allows the malware to download additional harmful samples onto the victim's machine, primarily info stealers like Danabot and StealC, and clippers. The injection chain results in the final stage being executed in the context of the explorer.exe process, which is a variant of the info stealer malware family StealC. Vortax, masquerading as a virtual meeting software, has been identified as a delivery mechanism for three potent info stealers—Rhadamanthys, Stealc, and Atomic macOS Stealer (AMOS). On Windows platforms, Vortax delivers Rhadamanthys and Stealc, while it loads the Atomic stealer on macOS platforms. The deceptive nature of Vortax and its ability to spread these info stealers across various platforms make it a significant threat to cybersecurity.