StealC V2 Spreads via Malicious Blender Files

Summary

The StealC V2 malware campaign represents a sophisticated attack leveraging malicious Blender files to distribute the StealC V2 infostealer to unsuspecting users worldwide. Discovered in 2025, the StealC V2 attack exploits Blender’s Python script auto-execution capabilities by embedding weaponized code inside seemingly harmless .blend 3D model files shared on popular asset platforms like CGTrader. The StealC V2 campaign has been active for at least six months, with evidence linking the operation to Russian-speaking threat actors. The StealC V2 infostealer infection chain initiates when victims open malicious Blender files, triggering concealed Python scripts that automatically download loaders, PowerShell scripts, ZIP bundles, and establish a full Pyramid C2 infrastructure. The StealC V2 malware targets Windows, macOS, and Linux platforms, harvesting sensitive data from over 23 browsers, more than 100 plugins and extensions, cryptocurrency wallets, messaging applications, VPN clients, and email programs. The StealC V2 threat demonstrates how attackers weaponize trusted creative tools to transform legitimate workflows into unexpected vectors for cyber intrusion and data theft.

Attack Details

The StealC V2 malware campaign exploits Blender Foundation files to deliver the rapidly evolving StealC V2 infostealer through a sophisticated multi-stage attack chain. For at least six months, StealC V2 operators have been quietly uploading malicious .blend files to platforms like CGTrader, disguising them as ordinary 3D assets. When opened in Blender, these StealC V2-weaponized files trigger concealed Python scripts that run automatically, transforming a trusted creative tool into a silent malware delivery mechanism.

Blender’s widespread popularity among 3D artists and designers plays a crucial role in the StealC V2 campaign’s success. As a free, open-source 3D creation suite supporting modeling, animation, rendering, and a thriving ecosystem of add-ons across all major operating systems, Blender attracts millions of users worldwide. The platform’s flexibility and community-driven growth make it ideal for professionals and hobbyists alike. However, this same flexibility introduces risk that StealC V2 attackers exploit. Blender allows Python scripts to be embedded directly into .blend files, and when Auto Run is enabled, those scripts execute instantly upon opening, creating opportunities for StealC V2 operators to weaponize the platform.

Although the Blender community had previously sounded general warnings about malicious Blender files, none of those discussions connected the activity to StealC V2 or any recognized threat actor. New evidence now suggests ties to Russian-speaking operators whose StealC V2 distribution tactics resemble earlier campaigns, including those impersonating the Electronic Frontier Foundation (EFF) to target Albion Online players. Both StealC V2 operations share familiar attack patterns including deceptive lure files, background execution chains, and the use of Pyramid C2 infrastructure to manage attacks.

The StealC V2 attack begins when a user opens a malicious .blend file containing weaponized Python scripts. If script auto-execution is enabled, the StealC V2 script retrieves a loader from a remote server, which then downloads a PowerShell script responsible for pulling down two ZIP archives. One archive contains a Python environment housing StealC V2, while the other delivers an auxiliary Python-based stealer component. These StealC V2 components unpack into the %TEMP% directory, where hidden LNK files are executed and made persistent via the Windows Startup folder. The StealC V2 infection chain culminates in the deployment of a Pyramid C2 module, where ChaCha20-encrypted Python scripts fetch additional payloads.

The final StealC V2 payload represents a powerful infostealer that has rapidly evolved since its introduction in April 2025. StealC V2 supports data extraction from more than 23 browsers, over 100 plugins and extensions, numerous cryptocurrency wallets, messaging applications, VPN clients, and email clients. The StealC V2 malware features an upgraded UAC bypass mechanism, enabling it to operate with elevated privileges without user consent. The StealC V2 campaign serves as a critical reminder of how even trusted creative tools can be weaponized by sophisticated threat actors, underscoring the growing need for cautious file handling practices and stronger security awareness training across creative industries.

Recommendations

Be Cautious when Downloading 3D Assets: The StealC V2 campaign relies on users downloading malicious Blender models from compromised or malicious sources. Only download Blender models from trusted creators or verified marketplaces with strong reputation systems. If a StealC V2 lure file looks unusual, has very few downloads, or comes from an unknown uploader, avoid opening it. Verify the authenticity of 3D assets before use to prevent StealC V2 infection.

Disable Auto Run for Python Scripts in Blender: StealC V2 attacks exploit Blender’s Auto Run feature that allows embedded Python scripts to execute automatically upon opening .blend files. Navigate to Edit → Preferences → File Paths in Blender and ensure Auto Run is disabled unless absolutely necessary for your workflow. Disabling Auto Run breaks the StealC V2 infection chain at the initial execution stage, preventing automatic malware deployment.

Scan Downloaded Files Before Opening: Even if a Blender file appears harmless and legitimate, StealC V2 operators disguise malicious code within seemingly normal 3D assets. Run all downloaded .blend files through antivirus or endpoint security tools before opening them in Blender. This scanning step can detect StealC V2 signatures and behavioral indicators before the malware executes.

Review Your Startup Folder Regularly: StealC V2 malware achieves persistence by hiding malicious shortcuts (LNK files) in the Windows Startup folder to execute every time the system boots. Regularly inspect your Startup folder for suspicious entries and remove any unfamiliar LNK files. Eliminating these persistence mechanisms can prevent StealC V2 from re-establishing control after system restarts.

Enhance Endpoint Protection: Deploy next-generation antivirus (NGAV) and endpoint detection and response (EDR) solutions specifically configured to detect StealC V2 behaviors. Leverage behavioral analysis and machine learning-based detection to identify suspicious StealC V2 activity patterns such as Python script execution from %TEMP%, unusual PowerShell activity, ChaCha20 encryption operations, and data exfiltration to known Pyramid C2 infrastructure. EDR solutions provide multiple opportunities to interrupt the StealC V2 kill chain across its multi-stage infection process.

Indicators of Compromise (IOCs)

IPv4 Addresses:

• 178[.]16[.]53[.]64
• 104[.]245[.]241[.]157
• 178[.]16[.]54[.]69
• 178[.]16[.]54[.]78
• 91[.]92[.]241[.]143
• 192[.]168[.]178[.]60
• 91[.]92[.]242[.]85
• 91[.]92[.]242[.]88
• 91[.]92[.]243[.]87

URLs:

• hxxps[:]//www[.]cgtrader[.]com/free-3d-models/character/man/spacesuit-nasa-apollo-11-84ff16e9-8b65-4faa-9b53-8aabb421b98f
• hxxps[:]//zalukina[.]avisregde1988[.]workers[.]dev/get-link
• hxxp[:]//91[.]92[.]243[.]91/documents/files/64CC37828HHKDeQ/[.]zip
• hxxps[:]//serikalikl[.]spoticualpe1970[.]workers[.]dev/get-link
• hxxp[:]//91[.]92[.]243[.]87[:]443/login/3keXipGb5Rr+gpGO9CjsSfdz+of
• hxxp[:]//213[.]209[.]150[.]224[:]443/login/3keXipGb5Rr+gpGO9CjsSfdz+of5
• hxxp[:]//212[.]87[.]222[.]84[:]443/login/3keXipGb5Rr+gpGO9CjsSfdz+of5
• hxxps[:]//zalypagylivera[.]nzalupadons1912[.]workers[.]dev/get-link
• hxxps[:]//zalypagylivera[.]disppomeverp1976[.]workers[.]dev/get-link
• hxxp[:]//178[.]16[.]54[.]69[:]443/login/3keXipGb5Rr+gpGO9CjsSfdz+of5
• hxxp[:]//178[.]16[.]54[.]69[:]443/login/w1GHz5ydpg/q
• hxxp[:]//91[.]92[.]241[.]143[:]443/login/w1GHz5ydpg/q
• hxxps[:]//new[.]tohocaper1979[.]workers[.]dev/get-link
• hxxps[:]//addons1[.]12cloudaddons198756[.]workers[.]dev/get-link
• hxxps[:]//addons1[.]poupathockm2ist10012[.]workers[.]dev/get-link
• hxxps[:]//[.]mouthrunnbeva1986[.]workers[.]dev/get-link
• hxxps[:]//[.]osloyverjua1977[.]workers[.]dev/get-link
• hxxps[:]//zovwowgyl[.]simzqlupasdali1976[.]workers[.]dev/get-link
• hxxp[:]//zovwowgyl[.]spoticualpe1970[.]workers[.]dev/get-link
• hxxp[:]//91[.]92[.]242[.]88[:]443/login/3keXipGb5Rr+gpGO9CjsSfdz+of5
• hxxp[:]//91[.]92[.]242[.]88[:]443/login/3keXipGb5Rr+gpGO9CjsSfdz+dqtXp32//B8qVKFSbc=
• hxxps[:]//zalypagylivera[.]opkerrira1972[.]workers[.]dev/get-link

SHA256 Hashes:

• FC16AB400800B3D6A05B6FB3884D5BA52ED097B8F50A2BEAB25442961B8FB8D0
• AD278E48574CB10FE84B9B46C8B7BEF4F71C25B29F3EDAC93829B675B736BD69
• 44a18a7431199cec3cd46b6c76ce8dbcb9201f181fd6f9906ed9ca742c5b87d
• 4c4fcb13e70c438799ffd7263b050b807f4416952955f3c65801cc63b92985d8
• 5681c26dae72c7a6f6b6e2f85fd3a3487888a6032c7a876bfbc4bf2c3a18ab97
• 8924df94890216c5b32142662e2131e0190163a2e96fa0183e5759a1dad89663
• 984cddf10b9aeda26d31de10bf6a020f8da61d15826fea7d90257ddf7e135368
• a7ee45c1f72872e61f219d561f16710947f3d18441fc730c4a8896ddb98583ea
• c3ab6d4bd8ee655fb8e5255a7acbcb39eb3fff013b9bd5893fd28e5d568fd0a5
• c62e094cf89f9a2d3b5018fdd5ce30e664d40023b2ace19acc1fd7c6b2347143
• 0C2BEDEA744686EBA1BFE116A0702F144FAD0B6020A8E91F12574398683A9DE5
• 7B4FC95BE7CA3BDE156FD53D10D05BF8C1A11D36155DC6179C9D4AFDD5E6862F
• 0DBF2EFBFFC23831A571BEFB1D830C2D5FD855061259C93D6E5DE35FAD9D5BC1
• 5DA95DE05A961989A4A67187E19A27143298E520B974D7F7C35A4BFCCB7F0BA4
• F2F8846D55221682124E1030AB8DB45A2AEE39400AF9D2410F8339294ECA8FA0
• FD4498A7F9BC714466A86F59AA4565A2B5F4C4EEE7C1A36E71FAC43D7C876ABD
• 158ABE39FF73E2EC950F4BC783020EB1F41BE0DC89C0A6B8032A3438EDDE9DFD
• 11FA573238720A06562476CD2BFCABEDBFF5661D5BC83AA0325521643C903BA1
• 7E59E79F48FD2279F9E8BFEFA91D79FEB4AFEF5720F7A338E46D2A6D1A607872
• A7E617783D7F1B0079C605126FBA074EE7EE431077CD97D391E41F364A0AFE1B
• 1AB530CDCE98295D0566E237E8E577CE4D77B73586EA7E7200D963831391E64B
• EA270CF9DB1F861FD59FF142444D32BBACC00003E9BB821A84E7F2B8F5277211
• DB799377A0FEDE856C12D3C7EB30ECDC30EC09B6C021C22D7C5D68E7A6F66109

MITRE ATT&CK TTPs

Initial Access:

• T1566: Phishing
• T1190: Exploit Public-Facing Application

Execution:

• T1059: Command and Scripting Interpreter
• T1059.001: PowerShell
• T1059.006: Python
• T1204: User Execution

Persistence:

• T1547: Boot or Logon Autostart Execution
• T1547.001: Registry Run Keys / Startup Folder

Privilege Escalation:

• T1548: Abuse Elevation Control Mechanism
• T1548.002: Bypass User Account Control

Defense Evasion:

• T1027: Obfuscated Files or Information
• T1140: Deobfuscate/Decode Files or Information
• T1036: Masquerading

Credential Access:

• T1555: Credentials from Password Stores
• T1555.003: Credentials from Web Browsers

Collection:

• (Implicit from attack description – browser data, credentials, wallets)

Command and Control:

• T1071: Application Layer Protocol

Exfiltration:

• T1041: Exfiltration Over C2 Channel

References

• https://www.morphisec.com/blog/morphisec-thwarts-russian-linked-stealc-v2-campaign-targeting-blender-users-via-malicious-blend-files/