VulnHub

Researchers have identified a cross-site scripting (XSS) vulnerability in the control panel of StealC malware, an infostealer that has been operating since at least 2023. This malware, which is sold as a service, targets and extracts sensitive information like cookies and passwords from victims. The flaw in the control panel has exposed important details about the attackers behind the malware, raising concerns about the ongoing threat to users' data security. Since its update to StealC v2 in 2025, the malware has continued to pose risks to individuals and organizations alike. The discovery emphasizes the need for vigilance against such malware, as the information leak could lead to further malicious activities by the attackers.

Researchers discovered a cross-site scripting (XSS) vulnerability in the web-based control panel of the StealC info-stealing malware. This flaw allowed them to monitor the malware operators' active sessions and collect data on their hardware setups. StealC is designed to steal sensitive information from users, which means this incident not only exposes the attackers but also raises concerns about the ongoing effectiveness of such malware. Understanding these vulnerabilities can help cybersecurity experts develop better defenses against similar threats. The incident serves as a reminder that even sophisticated malware can have weaknesses that researchers can exploit to gain insights into cybercriminal operations.