Security Bug in StealC Malware Panel Let Researchers Spy on Threat Actor Operations

Cybersecurity researchers disclosed a cross-site scripting (XSS) vulnerability in the StealC information stealer’s web-based control panel, enabling them to gather crucial insights into one of the threat actors using the malware in their operations. By exploiting the flaw, researchers collected system fingerprints, monitored active sessions, and — in a twist — stole cookies from the very infrastructure designed to steal them, according to CyberArk.

The StealC panel has historically been tied to a MaaS ecosystem and has seen updates such as Telegram bot notifications and redesigned panel, with the latest version dubbed StealC V2. Notably, CyberArk reported a YouTubeTA customer who used Google’s platform to distribute the stealer, accumulating over 5,000 logs containing 390,000 stolen passwords and more than 30 million stolen cookies.

In mid-July 2025, the threat actor’s location was exposed when they forgot to connect via VPN, revealing an IP linked to TRK Cable TV in Ukraine, highlighting the ongoing risks of operational security lapses in the MaaS model.