Loading story…
Researchers published technical analyses showing how modern infostealers including Aura Stealer and LummaC2 hide their logic with heavy control-flow obfuscation. The reports describe malware protected with dispatcher blocks, indirect jumps, and rewritten branch logic designed to frustrate reverse engineering and delay detection, highlighting how these techniques are being used to conceal credential theft and other malicious functionality.
Google Cloud's Mandiant team outlined a deobfuscation workflow for LummaC2 that uses Triton to resolve indirect jump destinations, traverses execution paths until termination points such as ret or ExitProcess, and reconstructs original functions by removing dispatcher code and rewriting indirect branches into direct control flow. A separate write-up on Aura Stealer similarly focused on defeating the malware's obfuscation layers, underscoring a broader trend of commodity stealers adopting more advanced anti-analysis protections that defenders and malware analysts must account for during triage and detection engineering.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Google Cloud's Mandiant Threat Intelligence blog published research describing a deobfuscation approach for LummaC2-protected functions, including use of Triton to recover indirect jump targets and rebuild original control flow.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**AuraStealer** has emerged as a growing malware-as-a-service infostealer operation, first advertised on Russian-language cybercrime forums and assessed to be run by Russian-speaking operators. Researchers describe it as a crude but actively developed clone of **LummaC2**, with subscription-based access, iterative releases through at least version `1.5.2`, and a theft focus spanning browser credentials, cryptocurrency wallets, authentication tokens, and host reconnaissance data. The malware uses layered obfuscation, anti-analysis techniques, and **AES-CBC** to protect both embedded configuration data and communications with its command-and-control infrastructure. Multiple campaigns have already delivered AuraStealer in the wild, including **ClickFix-style TikTok lures** and infections chained through malware loaders. Investigators identified **48 C2 domains**, with infrastructure largely masked behind **Cloudflare** and an apparent migration from `.shop` to `.cfd` domains over time. Additional reverse-engineering reports highlight continued code changes and operator efforts to complicate analysis further, while the backend administration panel reportedly relies on outdated software components even as the developers signal plans to add code virtualization.
Aug 14, 2026
Security researchers have identified two new infostealer malware families, Stealka and AuraStealer, both targeting Windows users through deceptive distribution methods. Stealka is primarily spread via fake game cheats, mods, and pirated software hosted on legitimate platforms such as GitHub, SourceForge, and Softpedia, as well as through convincing fake websites. Once executed, Stealka is capable of hijacking accounts, stealing cryptocurrency, and installing crypto miners on victim devices by harvesting sensitive data from browsers, applications, and crypto wallets. AuraStealer, on the other hand, is a malware-as-a-service (MaaS) offering that has gained traction on underground forums since mid-2025. It is marketed for its ability to steal data from over 110 browsers, 70 applications, and more than 250 browser extensions, with customizable configurations. Despite its advanced obfuscation and anti-analysis techniques, researchers have identified flaws that allow for detection and mitigation. Security experts have released deobfuscation scripts and configuration extractors to aid defenders in analyzing and countering AuraStealer's operations.
Jun 29, 2026
**Lumma Stealer** continued to expand as a prolific malware-as-a-service infostealer, with researchers reporting sharp growth in detections and increasingly diverse delivery chains. Microsoft attributed the malware and its command-and-control ecosystem to **Storm-2477**, which operates Lumma for affiliates that build payloads and run campaigns through a management panel. ESET reported Lumma detections surged **369%** in late 2024, while additional reporting from Netskope and other researchers highlighted ongoing **fake CAPTCHA/ClickFix** lures and fresh payload variants designed to evade detection. Observed campaigns used multiple infection paths, including phishing, malvertising, compromised websites, trojanized software, abuse of trusted platforms such as GitHub, and delivery by other malware including **DanaBot**. Microsoft described an early-April campaign that combined **EtherHiding** hosted through Binance Smart Chain smart contracts with ClickFix social engineering, and an April 7 campaign targeting Canadian organizations that used **Prometheus TDS** redirection plus `mshta` and PowerShell stages to deploy Lumma alongside **Xworm**. The malware was reported stealing credentials and cryptocurrency wallets, using process injection and hollowing, and relying on layered infrastructure with hardcoded domains and fallback channels through **Steam** and **Telegram** behind Cloudflare; Microsoft said its disruption effort led to the takedown, suspension, or blocking of about **2,300 malicious domains** tied to Lumma operations.
Aug 15, 2026