Executive Summary
Aura Stealer emerged in late 2025 as a prominent successor to Lumma Stealer, marketed as a native C++ information-stealing service. The malware is characterized by its highly evasive nature, employing five distinct layers of code and data obfuscation, including a 32-to-64-bit 'Heaven's Gate' transition specifically designed to bypass modern security controls for Chrome's App-Bound encryption. It maintains a heavy anti-analysis posture, with many samples intentionally crashing in sandboxes due to integrity checks and environment fingerprinting executed within global constructors before the main entry point.
Technically, Aura utilizes a runtime-pushed configuration model where stealing targets—including over 200 tasks for Chromium/Gecko browsers, crypto wallets, and VPN clients—are not hardcoded but received from a C2 server via AES-256-CBC encrypted channels. The infrastructure heavily relies on Cloudflare-proxied .cfd and .shop domains. While the malware implements advanced obfuscation like Control Flow Flattening (CFF) and SSE-based XOR string encryption, its transport protocol is weakened by prepending AES keys and IVs in plaintext within the transport envelope.
As of March 2026, the threat remains active with evolving versions (v1.5.1 and v1.5.2) and a broad target surface. Organizations should prioritize monitoring for the specific C2 heartbeat patterns and host-based indicators like the unique self-deletion command that utilizes fsutil to zero-out data, hindering forensic recovery.