Aurora Info Stealer MaaS

Aurora Stealer is an info-stealing malware offered as Malware-as-a-Service by a threat actor known as Cheshire. It had many functionality not limited to data stealing and remote access capabilities.

The researchers analyzed several hundreds of collected samples and identified dozens of active C2 servers.

The infection chains leveraged phishing pages impersonating download pages of legitimate software, including cryptocurrency wallets or remote access tools, and the 911 method making use of YouTube videos and SEO-poised fake cracked software download websites.

The attackers used methods to deliver the malware, including phishing websites masquerading as legitimate ones, YouTube videos and fake free software catalogue websites. It has targetted 40 applications till now.

Threat actors behind this malware also advertised its loader capabilities, the malicious code in fact is able to deploy a next-stage payload using a PowerShell command.

Aurora Stealer is becoming a prominent threats. Multiple threat actors, including traffers teams, added the malware to their arsenal.