StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them

Microsoft has announced a significant victory against cybercrime, with its Digital Crimes Unit (DCU) leading a coordinated effort to dismantle the operational infrastructure of the StealC and Amadey infostealers. This initiative, undertaken in partnership with Europol and various industry collaborators, targeted the command-and-control (C2) servers and domains essential for these malware families to function. StealC and Amadey represent a prevalent threat in the cybercriminal landscape, operating on a malware-as-a-service (MaaS) model. This means that threat actors can readily acquire and deploy these tools to facilitate their illicit activities. Amadey, active since at least 2018, serves as a primary loader, delivering not only StealC but also other malicious payloads like Lumma Stealer, remote access trojans (RATs), crypto miners, and even ransomware. The primary objective of these infostealers is to exfiltrate sensitive data, including usernames, passwords, and session cookies, from infected environments. The stolen credentials can then be used to gain unauthorized access to corporate virtual private networks (VPNs), single sign-on (SSO) accounts, and cloud services, effectively bypassing multi-factor authentication (MFA) in some cases. This poses a severe risk, as a compromise on an employee's personal device could quickly lead to a broader enterprise breach. In response to these threats, Microsoft recommends several mitigation strategies. Organizations should implement cloud-delivered protection through solutions like Microsoft Defender Antivirus to counter rapidly evolving malware variants. Utilizing attack surface reduction rules can prevent many common infection vectors. Furthermore, enabling tenant-wide tamper protection features is crucial to stop attackers from disabling security services or modifying antivirus exclusions. Regular credential hygiene, security awareness training, and robust endpoint detection and response (EDR) solutions are also vital components of a comprehensive defense strategy against such sophisticated infostealer campaigns.