Loading story…
Aurora Stealer, a Golang-based information stealer sold on Russian-speaking underground forums and Telegram, has been widely distributed through fake software installers, phishing pages, cracked-software lures, and spoofed download sites impersonating tools such as Notepad++, TeamViewer, and Nvidia Driver packages. Researchers said the malware evolved from a botnet marketed as malware-as-a-service into a broadly adopted stealer used by multiple traffer teams, with infections observed against organizations including manufacturers. Aurora steals browser data, cryptocurrency wallet files and extensions, Telegram session data, screenshots, and local files, while newer variants also target FTP and RDP credentials.
Aurora has also been delivered by the in2al5d p3in4er loader, a low-detection malware component compiled with Embarcadero RAD Studio that uses a GPU-based anti-VM check through dxgi.dll and CreateDXGIFactory to avoid sandbox analysis. After validating that the host uses NVIDIA, AMD, or Intel graphics, the loader decrypts and launches Aurora through process hollowing into sihost.exe or direct memory execution. Once active, Aurora fingerprints Windows hosts with WMIC, stores configuration data in base64, and exfiltrates stolen logs as compressed, base64-encoded JSON over TCP—commonly on port 8081—while also retaining loader functionality to fetch and execute additional payloads via PowerShell.
Pull IOCs and campaign context straight into your stack.
11 events from the most recent confirmed update back to the earliest known activity.
In April 2023, Morphisec publicly exposed the in2al5dp3in4er, or Invalid Printer, loader. The loader was described as using graphics-card-based sandbox evasion and delivering Aurora Stealer as its second-stage payload.
A March 2023 update to Aurora added capabilities including FTP and RDP credential theft and configurable ports for panel and command-and-control communications. This represented a functional expansion of the stealer.
Morphisec reported that Aurora became a popular Golang-based information stealer from late 2022 through the first quarter of 2023. The malware was delivered in campaigns using compromised YouTube accounts and fake download websites.
eSentire's Threat Response Unit observed Aurora Stealer infections affecting manufacturing organizations starting in December 2022. The infections were linked to fake Google Ads and spoofed software installers such as Notepad++, TeamViewer, and Nvidia Driver pages.
In October and November 2022, Sekoia observed several hundred Aurora samples and dozens of active command-and-control servers. This reflected a significant increase in operational scale after the malware's repositioning as a stealer.
By late August and September 2022, multiple traffers teams publicly announced that they had added Aurora to their infostealer arsenals. Sekoia identified nine such teams, indicating broader criminal adoption.
In late August 2022, Aurora was re-advertised on Telegram and underground forums as a stealer rather than a botnet service. This marked a shift in how the malware was positioned and sold to criminal users.
Sekoia observed Aurora server activity largely stop in late July 2022, with newer samples no longer appearing in a public repository. The report assessed that MaaS development may have been abandoned after the developer stopped posting in June 2022.
In July 2022, Sekoia discovered Aurora as a new Golang botnet and identified around 50 related samples, most tied to the Cheshire and Zelizzard botnets. It also observed fewer than a dozen associated command-and-control servers at that time.
Aurora was first advertised in April 2022 by a threat actor using the handle Cheshire as a multi-purpose botnet sold as Malware-as-a-Service. Early sales pitches included stealing, downloading, and remote access capabilities.
By late 2022, Aurora was being distributed through several infection chains, including phishing pages impersonating legitimate software, YouTube-led cracked software lures, and fake software catalog websites. Sekoia assessed that several threat actors were distributing Aurora using different delivery techniques.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 117 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
blog.sekoia.io
Open sourceblog.morphisec.com
Open sourceesentire.com
Open sourceresearch.openanalysis.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have identified two new infostealer malware families, Stealka and AuraStealer, both targeting Windows users through deceptive distribution methods. Stealka is primarily spread via fake game cheats, mods, and pirated software hosted on legitimate platforms such as GitHub, SourceForge, and Softpedia, as well as through convincing fake websites. Once executed, Stealka is capable of hijacking accounts, stealing cryptocurrency, and installing crypto miners on victim devices by harvesting sensitive data from browsers, applications, and crypto wallets. AuraStealer, on the other hand, is a malware-as-a-service (MaaS) offering that has gained traction on underground forums since mid-2025. It is marketed for its ability to steal data from over 110 browsers, 70 applications, and more than 250 browser extensions, with customizable configurations. Despite its advanced obfuscation and anti-analysis techniques, researchers have identified flaws that allow for detection and mitigation. Security experts have released deobfuscation scripts and configuration extractors to aid defenders in analyzing and countering AuraStealer's operations.
Jun 29, 2026
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026