Back Cybersecuritynews

Threat Actors Deploy ‘AuraStealer’ Infostealer with 48 C2 Domains and Active Campaigns

Cybersecuritynews •Tushar Subhra Dutta • March 3, 2026

A new information-stealing malware called AuraStealer has been making its presence felt across the cybersecurity landscape since mid-2025. Developed and actively maintained by a group of Russian-speaking individuals, the malware first appeared on underground hacker forums in July 2025, shortly after the disruption of the Lumma stealer infrastructure left a notable gap in the infostealer […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AuraStealer Infostealer Emerges with 48 C2 Domains Targeting Users AuraStealer, a new infostealer malware, has been active since mid-2025, developed by a group of Russian-speaking individuals. It was first introduced on underground forums in July 2025 and is currently utilizing 48 command and control (C2) domains in ongoing campaigns to target users. 3 sources 49

Extracted Entities

Threat Actors Deploy ‘AuraStealer’ Infostealer with 48 C2 Domains and Active Campaigns

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (1)