Amadey Loader Abuses Compromised Self-Hosted GitLab to Deliver StealC Infostealer (Campaign)

Amadey, an established malware loader, was observed abusing a compromised self-hosted GitLab instance (gitlab.bzctoons.net) to deliver the StealC infostealer; the loader uses custom Base64 with RC4 obfuscation, enforces mutex-based execution, creates scheduled-task persistence, spawns child processes (including a clipper via rundll32.exe and a StealC payload x64_protect.exe), and exfiltrates Chromium browser credentials while swapping copied cryptocurrency addresses to steal funds.