StealC V2 Malware Is Being Installed Through Malicious Blender Files

A new malware campaign is abusing Blender asset files to install the StealC V2 information stealer on user systems. Threat actors are uploading booby trapped .blend files to popular 3D model marketplaces, where unsuspecting artists and designers download them believing they are legitimate project assets. Once opened in Blender, the files trigger hidden Python scripts that launch a multi stage infection chain.

Malicious Blender Files Are Being Used as a Delivery Vector

The operation has been active for at least six months, according to new technical findings shared by Morphisec researchers. The attackers are taking advantage of a Blender feature that allows Python scripts to be embedded inside .blend files. When Blender’s Auto Run Python Scripts option is enabled, these scripts execute immediately upon opening the file. This is a known security risk documented by the Blender Foundation in its official guidance at Blender Manual.

Threat actors appear to be exploiting this feature by uploading malicious 3D assets to platforms such as CGTrader. The files contain a weaponized version of Rig_Ui.py, a script commonly used for character rigging. When opened, the script contacts remote servers and downloads additional payloads without the user’s knowledge.

The Multi Stage Loader Behind the Infection

The embedded Python code initiates the first stage by contacting a remote loader URL hosted on a Cloudflare Workers domain. From there, a PowerShell script is downloaded and executed to fetch multiple ZIP archives from attacker controlled infrastructure. These ZIP files contain the components required to deploy the StealC V2 malware and an auxiliary Python based information stealer.

The archives extract into the TEMP directory, after which the malware uses LNK shortcuts placed in Startup folders to persist. Additional stages rely on the Pyramid C2 framework, which delivers encrypted payloads that are decrypted on the victim system using ChaCha20.

This approach allows the malware to evade sandboxes, blend in with normal Blender workflows, and bypass security products that do not deeply inspect Python based execution chains.

StealC V2 Has Significantly Expanded Capabilities

StealC V2 is an upgraded version of the StealC infostealer that first circulated on underground markets in early 2025. The updated version supports credential theft, browser data extraction, extension scraping, cryptocurrency wallet theft, VPN client harvesting, and exfiltration of messaging application data.

According to threat intelligence gathered from cybercrime forums, the malware is actively marketed to low tier cybercriminals and includes server side decryption features for browser credentials, as well as support for Chrome 132 and other newer builds. It can extract data from more than twenty three browsers, one hundred browser extensions, and over fifteen desktop wallet applications.

Many of the samples associated with this campaign currently show very low detection on VirusTotal, making the threat more difficult to identify without behavioral protection.

Why Blender Is an Effective Target

Blender’s popularity, free licensing, and heavy use among artists, hobbyists, and indie developers make it an ideal target. Many users are unaware that .blend files can contain executable code, and the Auto Run feature is enabled in some projects because rigging and animation functionality depends on embedded Python. This creates an opportunity for attackers to deliver malware through files that appear harmless at first glance.

The attack also bypasses many traditional analysis environments because Blender commonly runs on systems with GPUs. Malware families often use GPU presence as a signal that the environment is not a sandbox, which allows the infection chain to continue without interruption.

How Users Can Protect Themselves

To avoid becoming a victim, Blender users should take the following precautions:

• Disable Auto Run Python Scripts by default in Blender preferences and only enable it for trusted projects.
• Avoid opening .blend files from unknown or unverified creators on marketplaces.
• Use caution when downloading free 3D assets, especially rigged characters or files that require scripts to function.
• Monitor systems for suspicious LNK files or unexpected PowerShell execution.
• Ensure endpoint protection can detect script based loaders and Python embedded execution chains.

The Campaign Is Ongoing

Researchers note that the infrastructure supporting this campaign is still active and that new malicious Blender assets continue to be uploaded across multiple 3D platforms. Some files have already reached large download numbers, increasing the risk to designers, animators, and anyone who uses Blender for creative work.

Morphisec has published a detailed technical breakdown of the campaign on its official site at Morphisec Research, including file hashes, domain indicators, and analysis of the infection stages.

The abuse of Blender assets to distribute malware highlights the growing trend of attackers targeting creative platforms and open source ecosystems. The combination of Auto Run scripting, user trust in 3D asset marketplaces, and low detection rates has made this campaign highly effective. As the StealC V2 malware continues to evolve, users should remain cautious when handling unfamiliar Blender files and follow the security recommendations outlined by Blender and independent researchers.

For more security updates and analysis, visit the Botcrawl Cybersecurity and Malware sections.