Threat Actors Deploy ‘AuraStealer’ Infostealer with 48 C2 Domains and Active Campaigns

AuraStealer is a Russian-speaking actor-developed information-stealing malware first advertised in mid-2025, positioned as a commercial stealer with subscription pricing, a management panel, and Telegram integration. Analysts found over 200 samples and 48 linked C2 domains (using .SHOP and .CFD TLDs routed through Cloudflare); it harvests browser credentials, crypto wallets, 2FA tokens, session cookies, VPN configs, password manager databases and more. Distribution uses social-engineering 'ClickFix' lures (notably malicious TikTok videos instructing users to run PowerShell), various loaders, DLL sideloading, process injection, and fake tools. The report documents active campaigns, evolving infrastructure, and provides mitigation recommendations including blocking known C2 domains, restricting PowerShell/admin access, application allow-listing, endpoint detection for injection, and user awareness training.