[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Playbooks

Infostealer-turned-RAT on a Windows endpoint (Stadia/StealC): scope, contain, rotate

What to do when a host shows Stadia-style signs: a hidden 15-minute task under ProgramData, a new Defender exclusion, or suspended-browser injection. Built from Varonis's Oct 22 analysis. Stadia adds hands-on remote access, so treat it as an intrusion, not just a stolen-password cleanup.

For: SOC, IR lead, Endpoint / Windows admin, Identity admin

1. Confirm and scope2. Contain the host3. Assume every browser secret on that host is stolen4. Hunt the fleet
  1. Step 1 of 4

    Confirm and scope

    Use behavior, because C2 IPs and keys change with each build.

    • Search Security events 4698/4702 for task XML containing Interval PT15M, Duration P3650D, Hidden true and a C:\ProgramData\ path (Varonis Sigma rule)
    • Look for unsigned EXEs in random 12-character ProgramData folders named like updaters (RuntimeBroker, MicrosoftEdgeUpdate, GoogleUpdate, AdobeARM and so on)
    • Check Defender exclusions and PowerShell Add-MpPreference -ExclusionPath events
    • Proxy/NDR: HTTP POSTs to the root path of bare IPs with Content-Type application/json and a Base64 body; for the known build, 93.152.213.215, 91.92.43.45 and 193.148.56.97
  2. Step 2 of 4

    Contain the host

    The operator may be watching the screen through hidden VNC.

    • Network-isolate through EDR before you remove anything, and preserve memory and the ProgramData folder
    • Remove the scheduled task, the binary and the Defender exclusion, then re-run a full scan
    • The loader can run EXE, PowerShell, CMD or MSI payloads from memory, so check for follow-on tools and reimage if anything else ran
  3. Step 3 of 4

    Assume every browser secret on that host is stolen

    The stealer module takes saved passwords, cookies and session tokens (including Azure), wallets and messenger data.

    • Revoke sessions and refresh tokens for the user in Entra ID and other SSO, then reset passwords from a clean device
    • Rotate any SaaS, cloud, VPN and developer credentials saved in the browser, and remove unknown MFA methods and devices
    • Tell the user to move crypto wallet funds to new seeds from a clean device
  4. Step 4 of 4

    Hunt the fleet

    One infected host usually means a shared lure.

    • Run the task, exclusion and network queries across all endpoints
    • Block the published hashes and IPs as a stopgap, and keep the behavioral rules running
    • Review how the payload arrived (download, cracked software, ClickFix). Varonis did not identify a delivery method

Original content by ctxsec. Printable checklist: use your browser's print view.