Loading story…
AuraStealer has emerged as a growing malware-as-a-service infostealer operation, first advertised on Russian-language cybercrime forums and assessed to be run by Russian-speaking operators. Researchers describe it as a crude but actively developed clone of LummaC2, with subscription-based access, iterative releases through at least version 1.5.2, and a theft focus spanning browser credentials, cryptocurrency wallets, authentication tokens, and host reconnaissance data. The malware uses layered obfuscation, anti-analysis techniques, and AES-CBC to protect both embedded configuration data and communications with its command-and-control infrastructure.
Multiple campaigns have already delivered AuraStealer in the wild, including ClickFix-style TikTok lures and infections chained through malware loaders. Investigators identified 48 C2 domains, with infrastructure largely masked behind Cloudflare and an apparent migration from .shop to .cfd domains over time. Additional reverse-engineering reports highlight continued code changes and operator efforts to complicate analysis further, while the backend administration panel reportedly relies on outdated software components even as the developers signal plans to add code virtualization.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Gen Digital published a deeper technical analysis of AuraStealer and examined version 1.5.2, showing the malware was under active development months after its initial forum advertising.
The domain auracorp[.]cfd, used for the AuraStealer panel, was first registered through Web Commerce Communications Ltd. Intrinsec later observed it resolving to Cloudflare IP addresses.
The user "AuraCorp" advertised AuraStealer on the Russian-language XSS forum, marking the malware's first observed appearance on hacker forums. Intrinsec assessed the operation as being run by Russian-speaking individuals.
Foresiet published an early technical analysis of AuraStealer, documenting the malware as a crude clone of LummaC2 and helping establish early public technical visibility into the threat.
After the initial XSS post, similar AuraStealer promotional posts appeared on Exploit, Darkmarket, Blackbones, Sinister, Enclave, and Darkstash, indicating broader criminal marketing of the stealer-as-a-service offering.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 359 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
intrinsec.com
Open sourceblog.xyris.mov
Open sourceforesiet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have identified two new infostealer malware families, Stealka and AuraStealer, both targeting Windows users through deceptive distribution methods. Stealka is primarily spread via fake game cheats, mods, and pirated software hosted on legitimate platforms such as GitHub, SourceForge, and Softpedia, as well as through convincing fake websites. Once executed, Stealka is capable of hijacking accounts, stealing cryptocurrency, and installing crypto miners on victim devices by harvesting sensitive data from browsers, applications, and crypto wallets. AuraStealer, on the other hand, is a malware-as-a-service (MaaS) offering that has gained traction on underground forums since mid-2025. It is marketed for its ability to steal data from over 110 browsers, 70 applications, and more than 250 browser extensions, with customizable configurations. Despite its advanced obfuscation and anti-analysis techniques, researchers have identified flaws that allow for detection and mitigation. Security experts have released deobfuscation scripts and configuration extractors to aid defenders in analyzing and countering AuraStealer's operations.
Jun 29, 2026
**Lumma Stealer** continued to expand as a prolific malware-as-a-service infostealer, with researchers reporting sharp growth in detections and increasingly diverse delivery chains. Microsoft attributed the malware and its command-and-control ecosystem to **Storm-2477**, which operates Lumma for affiliates that build payloads and run campaigns through a management panel. ESET reported Lumma detections surged **369%** in late 2024, while additional reporting from Netskope and other researchers highlighted ongoing **fake CAPTCHA/ClickFix** lures and fresh payload variants designed to evade detection. Observed campaigns used multiple infection paths, including phishing, malvertising, compromised websites, trojanized software, abuse of trusted platforms such as GitHub, and delivery by other malware including **DanaBot**. Microsoft described an early-April campaign that combined **EtherHiding** hosted through Binance Smart Chain smart contracts with ClickFix social engineering, and an April 7 campaign targeting Canadian organizations that used **Prometheus TDS** redirection plus `mshta` and PowerShell stages to deploy Lumma alongside **Xworm**. The malware was reported stealing credentials and cryptocurrency wallets, using process injection and hollowing, and relying on layered infrastructure with hardcoded domains and fallback channels through **Steam** and **Telegram** behind Cloudflare; Microsoft said its disruption effort led to the takedown, suspension, or blocking of about **2,300 malicious domains** tied to Lumma operations.
Aug 15, 2026
**Arkanix Stealer** emerged as a previously undocumented infostealer offered under a **malware-as-a-service (MaaS)** model, promoted via dark web forum advertisements that directed buyers to a Discord server for coordination. Analysis identified multiple implants, including a native **C++** variant with broad data-theft capabilities (e.g., system profiling and **cryptocurrency wallet** theft) and a **Python** implementation that can dynamically modify its configuration and is often packed to hinder analysis. The toolset also incorporated *ChromElevator*, a publicly available browser post-exploitation utility, and detections were mapped to families such as `Trojan-PSW.Win64.Coins.*` and `Trojan.Python.Agent.*`; the associated affiliate/referral program appeared to have been taken down, suggesting a short-lived operation. Separately, January 2026 telemetry and case analysis on infostealer distribution highlighted ongoing, high-volume delivery via **crack/keygen camouflage** and **SEO poisoning**, with prominent families including **LummaC2**, **Vidar**, and **ACRStealer**. The reporting emphasized automated collection and analysis pipelines that extract C2/IOC data and support near-real-time blocking via an indicator service, underscoring that infostealer operations continue to rely on scalable distribution and obfuscation techniques even as individual MaaS offerings like Arkanix may be transient.
Jun 29, 2026