Stadia Propose Change

Stadia is a Windows remote access trojan, stealer and loader sold as a subscription (Basic/Team/Pro tiers) since September 2026 by "plymouth", the seller previously behind Stealc.

The agent is a native C++ (MSVC) executable, built for x86 and x64, that imports only KERNEL32 and resolves all other APIs at runtime by name. Every sensitive string (API names, DLL names, JSON keys, task XML) is stored as Base64(RC4(plaintext)) with a per-build 18-character key placed in `.rdata` immediately after a `00..99` digit-pair table. C2 URLs and the nine install names are stored in plaintext.

References

There is no Yara-Signature yet.