Loading story…
Security researchers have identified two new infostealer malware families, Stealka and AuraStealer, both targeting Windows users through deceptive distribution methods. Stealka is primarily spread via fake game cheats, mods, and pirated software hosted on legitimate platforms such as GitHub, SourceForge, and Softpedia, as well as through convincing fake websites. Once executed, Stealka is capable of hijacking accounts, stealing cryptocurrency, and installing crypto miners on victim devices by harvesting sensitive data from browsers, applications, and crypto wallets.
AuraStealer, on the other hand, is a malware-as-a-service (MaaS) offering that has gained traction on underground forums since mid-2025. It is marketed for its ability to steal data from over 110 browsers, 70 applications, and more than 250 browser extensions, with customizable configurations. Despite its advanced obfuscation and anti-analysis techniques, researchers have identified flaws that allow for detection and mitigation. Security experts have released deobfuscation scripts and configuration extractors to aid defenders in analyzing and countering AuraStealer's operations.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
On December 18, 2025, Kaspersky published research describing Stealka's targeting of browsers, wallets, password managers, messaging apps, gaming clients, and VPN clients, and noted it could also install crypto miners. The company advised users to avoid pirated software, use antivirus protection, and reduce sensitive data stored in browsers.
On December 17, 2025, Gen Digital published a technical analysis of AuraStealer detailing its anti-analysis methods, encrypted configuration, C2 communications, and data-theft features. The report also shared reverse-engineering workflows, sample hashes, and suspected C2 domains.
By late 2025, AuraStealer was observed in 'Scam-Yourself' campaigns, including TikTok videos that tricked users into executing malicious PowerShell commands. These campaigns relied on users manually running attacker-provided commands to infect their own systems.
After its discovery, Stealka was identified as being spread through legitimate platforms including GitHub, SourceForge, and Softpedia, as well as convincing fake websites. The malware required victims to manually download and execute the malicious files.
Kaspersky said it discovered a new Windows infostealer called Stealka in November 2025. The malware was found masquerading as pirated software, game cheats, and mods to steal credentials, tokens, wallet data, and other sensitive information.
Gen Digital reported that the AuraStealer malware-as-a-service infostealer had been promoted on underground forums starting in July 2025. The Windows stealer was marketed as a low-footprint tool with broad data-theft capabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 39 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
infosec.pub
Open sourcekaspersky.com
Open sourcegendigital.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**AuraStealer** has emerged as a growing malware-as-a-service infostealer operation, first advertised on Russian-language cybercrime forums and assessed to be run by Russian-speaking operators. Researchers describe it as a crude but actively developed clone of **LummaC2**, with subscription-based access, iterative releases through at least version `1.5.2`, and a theft focus spanning browser credentials, cryptocurrency wallets, authentication tokens, and host reconnaissance data. The malware uses layered obfuscation, anti-analysis techniques, and **AES-CBC** to protect both embedded configuration data and communications with its command-and-control infrastructure. Multiple campaigns have already delivered AuraStealer in the wild, including **ClickFix-style TikTok lures** and infections chained through malware loaders. Investigators identified **48 C2 domains**, with infrastructure largely masked behind **Cloudflare** and an apparent migration from `.shop` to `.cfd` domains over time. Additional reverse-engineering reports highlight continued code changes and operator efforts to complicate analysis further, while the backend administration panel reportedly relies on outdated software components even as the developers signal plans to add code virtualization.
Aug 14, 2026
**Stealc**, a malware-as-a-service Windows information stealer advertised on Russian-speaking cybercrime forums in January 2023, rapidly gained criminal adoption. The malware borrows capabilities and design elements from Vidar, Raccoon, Mars, and RedLine, stealing browser credentials and cookies, cryptocurrency-wallet data, desktop-wallet files, and information from Discord, Telegram, Outlook, Steam, and Tox. Researchers observed more than 40 samples and at least 35 active command-and-control servers, with campaigns using YouTube videos and cracked-software downloads as lures. Stealc uses RC4 and Base64 string obfuscation, dynamic API resolution, sandbox checks, staged C2 tasking, and self-deletion following exfiltration. It is part of a broader active ecosystem of Windows stealers including RedLine, MetaStealer, and Agent Tesla: RedLine dominated observed telemetry during 2022–2023, while Agent Tesla activity increased through 2024. Defenders should prioritize detection of suspicious access to browser credential stores and cryptocurrency-wallet files, as well as unsigned executables communicating with Telegram or Discord infrastructure.
Sep 9, 2026
Cybercriminals are actively marketing new information-stealing malware-as-a-service (MaaS) offerings on underground forums, with a focus on targeting credentials, browser data, and cryptocurrency wallets. The "MioLab MacOS" infostealer is being promoted as a resident macOS malware with a web-based control panel, customizable settings, and support for stealing data from over 200 crypto wallet extensions and more than 15 password managers, including Apple Keychain and LastPass. The malware is sold via a subscription model, with additional modules for hardware wallets like Ledger and Trezor, and is designed to appeal to cybercriminals seeking to compromise Apple devices and digital assets. Separately, "SantaStealer" is a new infostealer being advertised on Telegram and hacker forums, operating as a rebranded version of BluelineStealer. It is promoted for its in-memory operation to evade detection, though researchers note its current samples are not as stealthy as claimed. SantaStealer features a user-friendly affiliate panel, multiple data-theft modules, and flexible configuration options, allowing attackers to tailor payloads for specific data theft objectives. Both malware families exemplify the growing sophistication and commercialization of MaaS operations, lowering the barrier for cybercriminals to launch targeted credential and asset theft campaigns.
Jun 29, 2026