StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them

Infostealers remain among the most pervasive cybercrime threats, silently harvesting passwords, cookies, and session tokens that enable enterprise breaches. StealC is a malware-as-a-service infostealer written in C++ that collects credentials from browsers, cryptocurrency wallets, messaging applications, email clients, and gaming platforms while functioning as a secondary loader. Amadey operates as a modular backdoor loader active since 2018, delivering downstream payloads including StealC, Lumma Stealer, and ransomware through various backdoor commands. Both operate on commodity rental models where stolen credentials flow through underground markets to access brokers who resell enterprise access. On June 24, 2026, Microsoft's Digital Crimes Unit coordinated with Europol to disrupt over 200 malicious command-and-control domains supporting these operations, using AI-assisted analysis tools including Microsoft Copilot for binary analysis and configuration extraction.

• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• September 2026 Infostealer Trend ReportMalware2026-10-28
• LiteLLM supply chain compromiseCampaign2026-10-22
• Grand Theft Auto VI Release Phishing LuresMalware2026-11-05