StealC
A newer stealer that borrows from Vidar, Raccoon and RedLine. What it takes from an infected computer, how it gets there, and how to check whether your logins ended up in its logs.
- Also called
- Stealc
- Seen since
- 2023
- Runs on
- Windows
- Sold as
- Malware-as-a-service on Russian-language forums
What StealC takes
- Browser passwords, cookies and autofill entries
- Cryptocurrency wallets and wallet extensions
- Data from messaging and email apps
- Files matching what the buyer asked for
How it spreads
- Fake cracked software
- YouTube videos with download links
- Malicious ads
Background
StealC appeared in early 2023 and was advertised as combining the best features of older stealers. Like them, it is rented to many different buyers, so its logs come from all over the world.
Checking for your logins
Search your email address, username or company domain on this site. The check covers stealer logs from every family, StealC included, and shows how many of your logins are in them, for which sites and where the devices were.
A stealer log doesn’t record which malware made it, so a result won’t say whether it was StealC or another stealer. The steps afterwards are the same either way: clean the device, then change passwords from a safe one.
Other infostealers
- RedLine Stealer: For years the most common source of stealer logs on the market.
- Lumma Stealer: The stealer behind the fake “verify you are human” pages.
- Vidar: A long-running stealer, often delivered together with other malware.
- Raccoon Stealer: A low-cost stealer whose alleged operator was arrested in 2022.
- Atomic macOS Stealer: Proof that Macs get infostealers too.
The full records are on Seer
This site shows how many stealer log records hold a login and a masked sample of them. Seer, which runs the check, shows every record in full: the saved logins and passwords, the cookies, the infected device and when the log was collected.
Seer also searches breach records and social accounts, so one email address shows everywhere it has leaked and every account it is linked to.
- Stealer log searchFull records from infected devices, by email, username, domain, password or IP address.
- Breached credentialsWhich data breaches an email address or username appears in, and what leaked with it.
- Social account searchThe accounts an email address, username or phone number is linked to across hundreds of sites.
- Plans and pricingA free account to start, and plans for investigators and security teams.