StealC is a commodity information stealer sold as malware-as-a-service, first observed in early 2023. In May 2025, Zscaler ThreatLabz published "I StealC You: Tracking the Rapid Changes to StealC," documenting a reworked second version that had been in the wild since March 2025. It is the main source behind this article.
//What Changed in V2
Zscaler describes a streamlined C2 communication protocol in the newer variants, using a JSON-based format and RC4 encryption. That is a change in shape and encoding from the earlier protocol, not a move to a different transport layer - the article's earlier claim that V2 moved to a full HTTP/2 implementation does not match Zscaler's description and has been dropped.
One detail Zscaler flagged as notable: the builder does not let the operator change the RC4 key. Zscaler's support team manages it centrally for clients, which is an unusual amount of centralised control for a malware-as-a-service product and a potential single point of failure for the operation if that key material is ever obtained.
Delivery and the control panel
V2 added loader options for MSI installer packages and PowerShell scripts, broadening how operators can chain the stealer into a larger infection. The redesigned control panel ships with an embedded builder, letting operators set payload rules and bot behaviour based on the victim's geolocation, hardware IDs and installed software - targeting logic configured at build time rather than negotiated with the C2 at runtime.
Other additions Zscaler documented: multi-monitor screenshot capture, a unified file grabber, and server-side credential brute-forcing. On the detection side, V2 checks for duplicate running instances and, beyond an expiration date baked into samples, excludes systems whose configured language is one spoken in the CIS - a common pattern among stealer operators based in or tolerated by that region, used to avoid infecting machines close to home.
A separate report from Daily Security Review notes that some earlier StealC features, including anti-VM checks and DLL-based payload execution, appear to have been removed in V2, though it is unclear from that report whether the removal was deliberate or a side effect of a broader codebase change. Zscaler's own write-up does not confirm or deny this, so it is listed here as single-sourced and unconfirmed.
//What This Means for Defenders
The practical shift is less about any single feature and more about pace: StealC's operators shipped a meaningfully different protocol, delivery options and control panel within roughly two years of the family's first appearance, which is typical of the malware-as-a-service model - iteration driven by what helps affiliates evade detection and what support burden the operators are willing to carry, not by a single technical breakthrough. Detection built around the V1 protocol shape should not be assumed to catch V2 traffic.