Security Flaw in StealC Malware Panel Exposes Threat Actor Operations

Cybersecurity researchers have disclosed a cross-site scripting (XSS) vulnerability in the web-based control panel of the StealC information stealer. This vulnerability allows for the collection of critical insights about the threat actors using the malware. The StealC malware first appeared in January 2023 as a malware-as-a-service (MaaS) offering, leveraging platforms like YouTube to distribute malicious software disguised as software cracks.

In a recent report, CyberArk researcher Ari Novick explained that exploiting this XSS flaw enabled them to gather system fingerprints, monitor active sessions, and even steal cookies from the malware’s own infrastructure. The malware has been propagated through various means, including rogue Blender Foundation files and social engineering tactics like FileFix.

StealC has undergone updates, including the introduction of a redesigned panel and Telegram bot integration, referred to as StealC V2. The source code for its administration panel was leaked, allowing researchers to identify characteristics of the threat actor’s systems, such as location indicators and hardware details.

The XSS flaw’s exact details remain undisclosed to prevent further exploitation. XSS vulnerabilities occur when user input is not properly validated, allowing attackers to execute malicious JavaScript in victims’ browsers, leading to cookie theft and sensitive information access.

Interestingly, the StealC developers failed to implement basic cookie security features, exposing their own session cookies to a textbook attack. A notable user of StealC, identified as YouTubeTA, has used YouTube to distribute the malware, amassing over 5,000 logs containing 390,000 stolen passwords and more than 30 million cookies.

This incident highlights the operational security blunders of the threat actor, who inadvertently revealed their real IP address by not using a VPN. This exposure linked them to a Ukrainian internet provider, indicating their location in Eastern Europe.

The findings underscore the risks associated with the MaaS ecosystem, which enables rapid threat actor operations while exposing them to security vulnerabilities similar to those faced by legitimate businesses.

• StealC: An information stealer that emerged in January 2023, allowing customers to distribute malware via YouTube.
• YouTubeTA: A threat actor using YouTube to distribute StealC, accumulating significant stolen data.
• CyberArk: The cybersecurity firm that reported on the XSS vulnerability in the StealC control panel.
• FileFix: A social engineering tactic used to propagate the StealC malware.
• StealC V2: The updated version of the StealC malware with enhanced features.