How Infostealers Are Fueling the Malware-as-a-Service Economy

Summary

Attackers are increasingly adopting Malware-as-a-Service (MaaS) models to distribute infostealer families such as AuraStealer, ACRStealer, and RemusStealer. These tools are designed to steal sensitive information including credentials, cryptocurrency wallets, and session tokens from compromised devices. The model lowers the barrier to entry for cybercriminals by offering ready-to-use malware through subscription and affiliate-based services.

Investigation

ReversingLabs researchers analyzed multiple infostealer samples observed between June and August 2026. The investigation examined the evolution of AuraStealer’s virtualization techniques, the rebranding of ACRStealer as Amatera, and the emergence of RemusStealer as a 64-bit LummaStealer variant that uses EtherHiding for C2 communication.

Mitigation

Users should remain cautious of unsolicited technical instructions, fake reCAPTCHA prompts, and suspicious social media video links. Organizations should deploy robust EDR/AV solutions and monitor for social engineering techniques such as ClickFix and ClearFake. Maintaining strong visibility into file integrity and process behavior is essential for identifying advanced evasion techniques including process hollowing.

Response

If infostealer activity is detected, affected hosts should be isolated immediately to prevent further data exfiltration. Responders should perform memory forensics to identify process injection or hollowing activity. All credentials accessed from the compromised system should be reset, and the original infection vector, including SEO poisoning or malvertising, should be investigated.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has successfully deployed an info-stealer on a workstation. To exfiltrate stolen credentials and system metadata, the malware attempts to reach its Command and Control (C2) infrastructure. The attacker utilizes the domain aimemtools.cfd to establish a connection. Additionally, to hide instructions within blockchain transactions, the malware performs a lookup/connection to ethereum.org. These actions are intended to trigger the specific domain and URL patterns defined in the detection logic.

• Regression Test Script:

  # Simulation Script: AuraStealer/Remus Stealer C2 Simulation
  # This script simulates network connections to the domains specified in the Sigma rule.
  
  Write-Host "[+] Starting C2 Communication Simulation..." -ForegroundColor Cyan
  
  # 1. Simulate connection to AuraStealer/Remus Stealer domain
  Write-Host "[+] Attempting connection to malicious domain: aimemtools.cfd" -ForegroundColor Yellow
  try {
      Invoke-WebRequest -Uri "http://aimemtools.cfd" -UseBasicParsing -TimeoutSec 5
  } catch {
      Write-Host "[!] Connection failed (expected if domain is sinkholed), but telemetry should be generated." -ForegroundColor Gray
  }
  
  # 2. Simulate connection to Ethereum for C2 via Smart Contract
  Write-Host "[+] Attempting connection to ethereum.org for stealthy C2" -ForegroundColor Yellow
  try {
      Invoke-WebRequest -Uri "https://ethereum.org/smart-contract-api" -UseBasicParsing -TimeoutSec 5
  } catch {
      Write-Host "[!] Connection failed (expected), but telemetry should be generated." -ForegroundColor Gray
  }
  
  Write-Host "[+] Simulation Complete." -ForegroundColor Cyan

• Cleanup Commands:

  # No persistent changes made by the simulation script.
  # No cleanup required.
  Write-Host "[+] Cleanup complete: No artifacts left behind." -ForegroundColor Green