Auraboros RAT Adds Live Audio, Keylogging, and Cookie Theft via Open C2 Panel

A security researcher discovered an unauthenticated Auraboros RAT command-and-control panel exposed at http://174.138.43.25:5000 that actively displays victim beacons and accepts live commands; the malware supports live audio streaming, intensive keylogging, browser credential and cookie theft, reverse SOCKS5 tunneling for session replay, and DLL sideloading-based implants. All APIs and Socket.io channels are served over plaintext HTTP with CORS set to *, allowing anyone to view victim data and command results in real time; the instance observed appears to be a developer’s home-lab beacon hosted on a DigitalOcean VPS, indicating the framework is high-risk but currently at limited scale.