Researchers Exploit Bug in StealC Infostealer to Collect Evidence

Researchers exploited an XSS flaw in the StealC infostealer's web panel to retrieve session cookies and operational data, enabling attribution of a StealC operator ('YouTubeTA') responsible for stealing about 390,000 passwords and over 30 million cookies; the analysis revealed device, language, timezone and ISP details and highlights risks introduced by the malware-as-a-service model and poor attacker infrastructure security.