Loading malware…
AuraStealer is a Windows malware-as-a-service infostealer that emerged in mid-2025 and has been advertised on multiple underground forums by operators assessed to be Russian-speaking. It is sold through subscription tiers and supported by a web-based management panel for campaign administration and stolen-data review, indicating an organized commercialized criminal operation under active development.
AuraStealer is designed to steal a broad range of victim data, including browser credentials, cookies and session tokens, cryptocurrency wallet material, two-factor authentication data, recovery seeds, API keys, VPN configurations, clipboard contents, screenshots, and general host and process information. It also targets password managers and data from numerous browsers, applications, and browser extensions. The malware can retrieve additional collection directives from command-and-control infrastructure and can execute follow-on payloads, extending its utility beyond simple credential theft.
Technically, AuraStealer employs substantial anti-analysis and defense-evasion measures. Reported protections include indirect control-flow obfuscation, string obfuscation, exception-driven API hashing, anti-debugging, anti-virtual-machine and anti-sandbox checks, anti-tamper logic, and geofencing that prevents execution in parts of the former Soviet Union. It stores embedded configuration data in AES-CBC-encrypted form and also protects command-and-control traffic with AES-CBC. AuraStealer has also been observed bypassing Chromium Application-Bound Encryption by injecting code into a browser context to recover protected keys, enabling theft of browser secrets that newer Chromium protections were intended to harden.
Observed delivery has relied heavily on social engineering. AuraStealer has been distributed in ClickFix-style and broader “Scam-Yourself” campaigns, especially through TikTok videos masquerading as software activation or installation tutorials that trick users into executing malicious PowerShell commands themselves. Additional observed distribution methods include cracked software, self-extracting archives, Visual Basic script chains, malicious loaders, Donut-based shellcode delivery, DLL sideloading, and process injection into legitimate Windows binaries.
AuraStealer targets Windows systems, with reporting indicating compatibility from Windows 7 through Windows 11. Its combination of broad data-theft coverage, active development, layered obfuscation, MaaS commercialization, and flexible delivery through social-engineering and loader ecosystems makes it a notable contemporary infostealer threat.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
42 distinct techniques documented for this family, organized by ATT&CK tactic.
Victims manually execute attacker-supplied PowerShell commands (from video or clipboard) in elevated PowerShell / Run dialog to fetch & run the payload.
Heavy direct and obfuscated use of WinAPI/NTDLL (e.g., VirtualAlloc, NtCreateSection, NtMapViewOfSection, NtCreateThreadEx, COM IElevator::Decrypt).
Execution always requires user action (copying & pasting commands, running an installer, enabling a VS Code extension).
Indirect control flow obfuscation; XOR-encrypted constants and strings; AES-encrypted embedded configuration; API hashing; exception-driven control flow.
Custom exception-driven API hashing (MurmurHash3 + FNV-1a + XOR) with lookup tables and deliberate exceptions to resolve and call WinAPI.
Injection into browser processes using NtCreateSection + NtMapViewOfSection + NtCreateThreadEx to run shellcode for ABE bypass.
Configuration option to self-delete on completion of data theft, removing forensic artifacts of the stealer binary.
Runtime decryption of strings and AES-CBC decryption of embedded configuration data.
"injected into legitimate Windows processes like regasm.exe and SndVol.exe"
Refuses to run in certain locales (CIS, Baltic states) via LCID and country code checks; additional anti-VM, anti-sandbox, and human-presence checks restrict execution to “real” user systems.
Combined VM/sandbox detection: hypervisor bit, screen size, RAM, CPU count, process count, blacklisted DLLs; ensures execution only on suitable targets.
Uses cpuid hypervisor bit, screen resolution (GetWindowRect > 1024), non-zero physical memory, CPU-count + process-count heuristic for VM vs real host, and blacklist of sandbox-related DLLs.
Sleep-hook detection via GetSystemTimePreciseAsFileTime before/after Sleep(1000); <900 ms indicates hooked/accelerated sleep.
Position-independent shellcode mapped into remote process memory via sections and executed without conventional module loading.
Reads PEB (BeingDebugged, NtGlobalFlag), checks KUSER_SHARED_DATA; uses NtCreateDebugObject + NtQueryObject to detect extra handles; scans running processes against debugger/monitor blacklist; inspects return addresses for INT3/UD2 and introduces delayed stack corruption.
Steals browser cookies and active session data (discord/telegram/steam session tokens) from browser profiles.
Reads credentials/API keys from local config files (e.g., RDP/AnyDesk configs, FileZilla credentials, VPN configuration files, wallet data files).
Steals credentials and secrets from password managers (KeePass, Bitwarden, 1Password, LastPass) and other local stores.
Enumerates running processes to perform anti-VM (process count) and anti-debug (blacklisted analysis tools) checks; also exfiltrates process list.
Collects general system fingerprinting data; uses system metrics extensively in anti-VM/anti-sandbox logic.
Combined VM/sandbox detection: hypervisor bit, screen size, RAM, CPU count, process count, blacklisted DLLs; ensures execution only on suitable targets.
Uses cpuid hypervisor bit, screen resolution (GetWindowRect > 1024), non-zero physical memory, CPU-count + process-count heuristic for VM vs real host, and blacklist of sandbox-related DLLs.
Sleep-hook detection via GetSystemTimePreciseAsFileTime before/after Sleep(1000); <900 ms indicates hooked/accelerated sleep.
Module and process enumeration to detect security tools, emulators, debuggers, and sandbox indicators (DLLs and process names).
Compares GetUserNameW/GetComputerNameW against known Microsoft Defender emulator values (JohnDoe, HAL9TH) and checks loaded modules against blacklist of analysis/sandbox DLLs.
Reads PEB (BeingDebugged, NtGlobalFlag), checks KUSER_SHARED_DATA; uses NtCreateDebugObject + NtQueryObject to detect extra handles; scans running processes against debugger/monitor blacklist; inspects return addresses for INT3/UD2 and introduces delayed stack corruption.
Steals files from local disk, including via wildcard-based search (configurable masks, paths, recursion) for arbitrary files of interest.
Aggregates collected data into local archives, then splits them into chunks prior to exfiltration.
...routing all traffic through Cloudflare as a reverse proxy to conceal the real server.
"To hide the real server, the actor routes all traffic through Cloudflare as a reverse proxy."
359 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as a comparison family that did not technically match the observed sample.
Referenced as a stealer family with a similar crypter-check/warning-dialog mechanism, though implemented differently by requiring entry of a randomly generated code.
An emerging infostealer.
Referenced as an infostealer family reported by other researchers as being delivered in the same campaign ecosystem.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.