New: Threat Exposure Validation Impact Report 2025
Learn More
Come meet us at Black Hat USA 2025 | Booth 1640
Book a Meeting

Aurora Stealer Leverages Shapeshifting Tactics And Popular Applications To Target Users

January 22, 2023

A threat actor was discovered mimicking legitimate websites to host and deliver the 9002 RAT, also known as Aurora, Hydraq, and McRat. Binary padding, system checks, and obfuscation were used in an attempt to evade antivirus software detection. The malicious software exfiltrates a range of data including system information and data from web browsers, crypto wallets, and certain user directories.