StealC malware control panel flaw leaks details on active attacker

Researchers uncovered an XSS flaw in StealC malware’s control panel, exposing key details about a threat actor using the info stealer. StealC is an infostealer that has been active since at least 2023, sold as Malware-as-a-Service to steal cookies and passwords, with StealC v2 released in 2025 before the web panel was leaked and criticised by researchers.

Analysis of the leaked code revealed a flaw that let investigators monitor StealC operators, collect system data, track sessions, and even steal cookies from the malware’s own infrastructure, according to CyberArk. The operator behind the campaigns, dubbed “YouTubeTA,” appeared to be a single individual, not a group, based on panel data showing one admin user, consistent hardware fingerprints, and a repeated use of the same device.

In 2025, YouTubeTA ran campaigns linked to YouTube, stealing data from thousands of victims worldwide, including via hijacked creator accounts to spread more malware. Researchers emphasise the MaaS model and the ease of compromising identity security, as highlighted in CyberArk’s report.