StealC V2 spread via malicious Blender files on 3D model sites like CGTrader, abusing Blender’s ability to run hidden Python scripts.
Cybersecurity firm Morphisec reported that Russian threat actors are spreading StealC V2 infostealer via weaponized Blender files uploaded to 3D model marketplaces like CGTrader. The malware abuses Blender’s ability to run Python scripts for automation and add-ons.
The campaign is still ongoing and has been active for at least six months.
“In recent months, Morphisec has successfully prevented multiple sophisticated malware campaigns leveraging Blender Foundation files to deliver the notorious StealC V2 infostealer.” reads the report published by Morphisec. “This ongoing operation, active for at least six months, involves implanting malicious .blend files on platforms like CGTrader. Users unknowingly download these 3D model files, which are designed to execute embedded Python scripts upon opening in Blender—a free, open-source 3D creation suite.”
New warnings about malicious .blend files surfaced online, but none tied them to StealC or Russian threat actors until now. Fresh evidence links this Blender campaign to past Russian operations, including fake EFF lures targeting Albion Online players with StealC v2 and Pyramid C2. Both use decoys, evasion, and silent execution. This analysis outlines the attack chain, full infrastructure, and how Morphisec blocked the threats early.
Blender is a free, cross-platform 3D suite popular for modeling, animation, and rendering, supported by a large community and many add-ons. A built-in feature that enables abuse is the ability to embed Python scripts inside .blend files via the bpy.data.texts field. Legitimate scripts like Rig_Ui.py add rig-control interfaces, but if Auto Run Python Scripts is enabled, any embedded code runs automatically when the file opens. Attackers exploit this to deliver malware, since Blender typically runs on physical GPU-equipped systems, helping it evade sandboxed analysis. Keep Auto Run disabled unless the file source is trusted.
Threat actors upload weaponized .blend files to 3D asset sites, embedding Python scripts that auto-execute in Blender when Auto Run is enabled.
The Rig_Ui.py script downloads a PowerShell loader, which retrieves ZIP archives containing StealC and an auxiliary Python stealer. The payloads extract to %TEMP%, establish persistence via hidden LNK files in Startup, and use Pyramid C2 to fetch encrypted modules. StealC V2, updated through mid-2025, adds expanded browser, wallet, messaging, and VPN-theft capabilities.
“Keep Auto Run disabled unless the file source is trusted. Attackers exploit Blender that typically runs on physical machines with GPUs, bypassing sandboxes and virtual environments.” Morphisec researchers recommend.
Morphisec reports that the StealC sample used in this campaign is the newest variant of StealC V2, previously analyzed by Zscaler. This updated version significantly expands its theft capabilities, supporting data exfiltration from over 23 browsers with server-side credential decryption (including Chrome 132+), more than 100 crypto-wallet extensions and 15 wallet apps, and messaging and VPN clients such as Telegram, Discord, Tox, Pidgin, ProtonVPN, OpenVPN, plus Thunderbird. It also features an improved UAC bypass.
Many of the samples discovered by Morphisec in VirusTotal have an extremely low detection ratio.
The report includes indicators of compromise (IoCs)
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, StealC V2)
