Aurora Stealer is a Windows information-stealing malware family written in Go that emerged in 2022 and has been sold through a malware-as-a-service model on Russian-speaking criminal forums. It has been observed in financially motivated campaigns targeting organizations and individual users, including infections in the manufacturing sector, and is commonly delivered through malvertising and fake software download pages impersonating popular applications and vendors. Aurora Stealer has also been distributed through pay-per-install ecosystems and loader chains including HijackLoader, also tracked as IDAT Loader or RUGMI, and has appeared in campaigns associated with the SteelClover cluster.
Its core function is theft of sensitive data from infected systems. Aurora Stealer collects browser-stored credentials, cookies, autofill data, and other browser artifacts from Chromium-based browsers, and reporting also attributes theft of browser data from major browsers including Chrome, Edge, and Firefox in some deployment chains. It can steal cryptocurrency wallet data from numerous wallet applications, capture Telegram Desktop session data, take screenshots, and gather host profiling information such as operating system and hardware details. Later versions added theft of FTP and Remote Desktop credentials. The malware also includes grabber functionality for collecting attacker-selected files and folders.
Aurora Stealer supports additional post-compromise functionality beyond simple data theft. Builds have included an embedded loader capable of downloading and executing further payloads or launching PowerShell commands, and the broader service offering has advertised auxiliary modules for remote access, brute force, scanning, and DDoS-style botnet activity. Exfiltration is performed through structured communications with command-and-control infrastructure, with stolen data packaged and transmitted in encoded and compressed form. The malware also supports operator notifications through Telegram.
The family uses multiple evasion and deployment techniques. Reported samples use junk-byte padding, packing or crypting, and anti-analysis measures. Aurora Stealer is frequently delivered via fake installers promoted through Google Ads and other traffic acquisition methods, often masquerading as legitimate software such as text editors, remote administration tools, collaboration software, or hardware drivers. In other cases it is the final payload of multi-stage loader chains that use DLL sideloading, process injection, persistence mechanisms, and living-off-the-land execution to establish and protect execution before deploying the stealer.
