Our tracking infrastructure has been following a distribution shift in the StealC operator base since the start of 2026. StealC v2, which absorbed a large share of the displaced Lumma affiliates after the May 2025 Lumma takedown, has moved its primary delivery lure away from cracked-software pages and toward fake AI-tool installers. This report covers what we observed across our sinkholes and honeypots over a 30-day window (April 28 to May 27, 2026), with a full IOC table at the end.
Key metrics
Over the 30-day window our sinkholes captured 1,140,000 check-ins attributable to StealC v2, across an estimated 71,000 unique infected hosts (deduplicated by agent ID where the v2 protocol issues one, by source IP per 24-hour window otherwise). That is consistent with the 38,200 daily figure we reported in the April 27 to May 3 weekly report, and it makes StealC the highest-volume Windows infostealer on our tracker for the period.
The lure shift: cracked software to fake AI tools
Through 2024 and most of 2025, StealC distribution leaned on the same SEO-poisoned cracked-software pages that the 2024 Lumma campaign used. Since roughly February 2026 we have observed a clear pivot. The dominant lure is now a fake installer for a named AI tool: desktop clients for chat assistants, “local LLM runner” utilities, AI image and video generators, and AI-branded productivity add-ins. The landing pages are well-built copies of real product sites, frequently promoted through sponsored search results and short-lived social posts rather than organic SEO.
The shift is rational from the operator’s side. AI-tool search demand is high and the audience skews toward users who will download and run an unsigned desktop binary to get a tool they have seen referenced online. The cracked-software audience has been heavily targeted for years and is comparatively saturated.
Infection chain
The chain has three stages, consistent with what we documented for the v2 builder in our StealC v2 packer YARA release.
Stage one: the user downloads what looks like an AI-tool installer, typically a 20-40 MB package. Most samples we collected are NSIS or MSI wrappers carrying an encrypted payload. A subset uses a signed-but-abused installer framework to clear basic reputation checks.
Stage two: on execution the wrapper drops a small loader to the user’s AppData directory and establishes persistence via a scheduled task or a Run key. The loader resolves its C2 using the v2 multi-layer scheme: an outer-layer decrypt, then a base64 inner structure carrying the C2 list and a fallback dead-drop resolver (we have observed Telegram channel descriptions and Steam profile bios used as the dead drop, the same resilience pattern Lumma used).
Stage three: the StealC payload is pulled, decrypted, and run. It harvests browser credentials and cookies, cryptocurrency wallet files, and desktop application tokens, then exfiltrates over the v2 network protocol. The protocol does not match the older StealC v1 signatures, which is why detection content needs the v2-specific rules.
Distribution infrastructure
We mapped 64 distribution domains active during the window. The naming pattern is consistent: an AI product or category name combined with terms like “app”, “desktop”, “studio”, “get”, or “ai”. Registration clusters in short windows through a small set of registrars, and the landing-page hosting concentrates on a handful of providers. We will publish a deeper infrastructure breakdown, including the registrar and hosting concentration and the sinkhole-derived victim geography, in a forthcoming infrastructure update covering the loader layer that stages a meaningful share of these infections.
MITRE ATT&CK mapping
| Tactic | Technique | Observed behavior |
|---|---|---|
| Resource Development | T1583.001 Acquire Infrastructure: Domains | 64 distribution domains, clustered registration |
| Initial Access / Execution | T1204.002 User Execution: Malicious File | Fake AI-tool installer run by the user |
| Persistence | T1053.005 / T1547.001 | Scheduled task and Run-key persistence |
| Defense Evasion | T1027 Obfuscated Files or Information | v2 multi-layer config encryption, PEB-walk API resolution |
| Credential Access | T1555 / T1539 | Browser credential, cookie, and wallet theft |
Indicators of compromise (sample)
Abbreviated for readability. The full export is published to our feed at dev.virustracker.info/lists/ and recent samples are available via MalwareBazaar; active C2 is queryable on ThreatFox.
| Type | Indicator (truncated) | Context |
|---|---|---|
| SHA256 | 9c4f8a…e1d2 | NSIS installer, fake “local LLM runner” |
| SHA256 | 71b3de…9a04 | Loader stage, AppData drop |
| C2 domain | cdn-update[.]live | Active during window |
| C2 domain | secure-config[.]xyz | Active during window |
| Distribution domain | get-llmstudio[.]app | Fake AI-tool lure |
| Distribution domain | desktop-aichat[.]com | Fake AI-tool lure |
| Dead-drop resolver | t[.]me/<redacted> | Fallback C2 resolution |
Methodology and references
Figures come from check-ins to our sinkhole and honeypot infrastructure during April 28 to May 27, 2026, deduplicated as described above. We treat check-in counts as a population proxy, not a confirmed victim count. For corroborating data the abuse.ch family remains the most useful public source; the Malpedia StealC entry aggregates public analysis and existing YARA coverage. Our companion v2 packer YARA rules detect the samples described here, and the Raccoon Stealer v3 analysis is the closest prior family writeup for comparison.
The next report in this thread maps the Amadey loader infrastructure that stages a significant share of current StealC v2 infections, including registrar and hosting concentration and victim geography.