Loading malware…
Aura Stealer is a native C++ information-stealing malware offered as a stealer-as-a-service operation since July 2025. It was advertised as a post-Lumma replacement to the same buyer base after the Lumma takedown, and reporting indicates it was promoted on underground forums including xss, exploit, Hack Forums, and BHF. The operators have claimed migration from other stealer ecosystems including Lumma, StealC, Vidar, and Rhadamanthys. Aura has also been observed delivered via ClickFix-style social engineering, including a TikTok campaign that instructed users to run malicious activation commands.
Aura employs substantial anti-analysis and obfuscation measures. Reported techniques include patched ImageBase values, Heaven’s Gate 32-to-64-bit transitions, a 32-to-64-bit trampoline, control-flow flattening, FNV-1a API hashing, AES-256-CBC-encrypted embedded configuration, XOR-encrypted strings, constructor-based anti-sandbox execution before WinMain, binary integrity verification with MapFileAndCheckSumW, anti-debug checks, breakpoint detection, username checks, and process blacklists. Its anti-analysis blacklist includes tools such as ida64.exe, x64dbg.exe, Wireshark.exe, Fiddler.exe, procmon.exe, windbg.exe, and frida-helper binaries. Aura also excludes CIS systems and locales through host-side checks and server-side IP checks; reported excluded locale codes include AM, BY, and GE.
Aura communicates with command-and-control infrastructure over WinHTTP, performing heartbeat requests to /api/live and retrieving tasking from /api/conf. Reported embedded or associated C2 domains include glider[.]cfd, magicupdate[.]cfd, searchagent[.]cfd, and mscloud[.]cfd, with glider[.]cfd reported as the only functioning backend as of 2026-03-28. Researchers replayed the client handshake against glider[.]cfd and decrypted a 42,658-byte server configuration. Aura uses AES-256-CBC for transport messages, but the 32-byte key and 16-byte IV are prepended in plaintext to each message, leaving TLS as the only effective wire protection.
Aura builds a structured exfiltration report labeled AURA containing HWID, launch time, privilege status, system information, hardware details, running processes, and installed software. It reads MachineGuid from SOFTWARE\Microsoft\Cryptography for HWID generation and queries SOFTWARE\Microsoft\Windows NT\CurrentVersion for OS version data. It creates a per-build mutex in the form Global{random_token} to enforce single-instance execution. Optional behaviors include a human_check prompt requiring user input before continuing and a self-delete routine that wipes the file with fsutil file setZeroData and deletes it via cmd.exe and del.
The malware targets a broad set of data sources. Researchers reported a server-pushed configuration version 1.1.0 defining 212 stealing tasks across 172 unique targets, including 99 Chromium browser targets, 13 Gecko browser targets, 98 file-grabber tasks, one system-info task, and one screenshot task. Hardcoded browser-related targets include Local State, Login Data, Web Data, Network\Cookies, History, Bookmarks, Last Version, and /MasterKey.bin. Reported theft targets include Chromium and Gecko browsers, Chrome App-Bound encryption material, more than 30 cryptocurrency wallets, VPN clients such as OpenVPN, NordVPN, and ProtonVPN, password managers such as KeePass, messaging and communications applications including Discord, Telegram, Pidgin, Psi+, and qTox, remote access and utility software such as AnyDesk and FileZilla, and gaming platforms including Steam and Uplay.
Observed sample details in the reporting include version 1.5.1 and 1.5.2 builds, including a PE32 GUI executable compiled with MSVC 14.0 and sample SHA256 90a1fb5ef34cc6abee75e7b39166b3cbb97d5545496251ea69c4d4372aa4c3fe. A total of 104 unique Aura samples reportedly passed through Triage since November 2025, where submissions were classified as aura_stealer and often crashed before normal execution due to the malware’s anti-analysis logic.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
At the moment, we have a code virtualization module ready, which we have not yet specifically implemented in our builds so that they can be researched. After several interesting technical reports appear, we will completely virtualize our code, and analyzing it will become a very difficult task.
The hash table is populated during init via GetModuleHandleA("ntdll.dll") and LdrGetProcedureAddress, with API addresses stored XOR-encrypted... The binary resolves 100+ APIs at runtime through the FNV-1a hash table and CFF dispatch.
When self_del is true in the config, the binary wipes and deletes itself after exfiltration... cmd.exe /c taskkill /f /im <process> & fsutil file setZeroData offset=0 length=<size> <path> & del /f /q <path>
Every Aura sample crashes in the Triage sandbox. The anti-sandbox code runs in global constructors (_initterm_e), not in WinMain... One or more of them contain: MapFileAndCheckSumW binary integrity verification, Software breakpoint detection on return addresses, Anti-debug checks.
OS version data comes from the registry at SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion... The binary also calls... RegOpenKeyExW("SOFTWARE\\Microsoft\\Cryptography") + RegQueryValueExW("MachineGuid") for HWID.
Process blacklist scan via CreateToolhelp32Snapshot + Process32FirstW / Process32NextW... [Processes List] {running processes}
The binary builds a structured text document with the self-identification marker AURA... [System Info] Architecture, Language, Keyboard Layouts, Time Zone, Computer Name, User Name, Screen resolution, OS Name... [Hardware] CPU, RAM, GPUs.
The file grabber tasks target application data directories under %appdata%, %localappdata%, and %programfiles%... steal files matching glob patterns from target directories.
Every Aura sample crashes in the Triage sandbox. The anti-sandbox code runs in global constructors (_initterm_e), not in WinMain... One or more of them contain: MapFileAndCheckSumW binary integrity verification, Software breakpoint detection on return addresses, Anti-debug checks.
Heartbeat: /api/live... The binary sends a multipart POST with a single field named data containing a base64-encoded envelope... Data exfil POST /api/send.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Native C++ information stealer sold as a service. It uses multiple obfuscation layers, anti-sandbox and anti-debug logic, runtime server-pushed tasking, and steals data from browsers, crypto wallets, VPN clients, password managers, messaging apps, and system information. It also supports screenshot capture and self-deletion.
Information-stealing malware; developer claims it includes CIS-region avoidance checks (system and IP-based) to prevent execution/operation in CIS countries.
An information-stealing malware offered as a MaaS-style product, positioned by its operators as a rapidly growing stealer with customer support, anti-CIS checks, and planned code virtualization to hinder analysis.
Aura is an infostealer malware distributed via ClickFix and FileFix attacks, designed to harvest browser credentials, crypto wallets, and other sensitive data.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.