Threat reportMalwareTL-2026-3864
Meduza Stealer: Windows infostealer MaaS with possible Aurora Stealer developer overlap
Meduza Stealer (TL-2026-3864), also tracked as Meduza, is a medium-severity malware campaign, first published 2026-10-19. It has no confirmed attribution, affects Microsoft Windows, maps to 14 MITRE ATT&CK techniques (T1005, T1012, T1059.001), and is covered by 9 detection rules and 37 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 37Indicators of compromise
Key facts for TL-2026-3864
- Threat ID
- TL-2026-3864
- Also known as
- Meduza, MeduzaStealer
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, cryptocurrency, finance, technology
- Target regions
- Global (excluding CIS countries and Turkmenistan)
- Detection rules
- 9
- Indicators of compromise
- 37
Malware and tooling in Meduza Stealer
Malware and tooling: Aurora Stealer, HijackLoader, Meduza, Meduza Stealer
How Meduza Stealer works
Meduza Stealer is a C++ Windows information stealer sold as a subscription service on underground forums and Telegram. It targets 19 password manager applications, 76 cryptocurrency wallets and 95 web browsers, plus Discord and Steam. RussianPanda's source code analysis found references to Aurora Stealer, suggesting possible developer overlap.
Meduza Stealer is a Windows-based information stealer first publicly documented by Uptycs (blog dated 2023-06-30) and widely reported on 2023-07-03. It is offered as malware-as-a-service on the XSS and Exploit.in underground forums and a Telegram channel at $199/month, $399/3 months or $1,199 lifetime. Subscribers manage their builds and stolen data through a web panel that allows customizing binaries and downloading or deleting exfiltrated data. The seller stated that operations do not involve ransomware activity.
Execution flow described by Uptycs: the sample first checks the victim's geolocation using GetUserGeoID/GetGeoInfoA and aborts if the victim is in an excluded country (CIS states and Turkmenistan: Russia, Kazakhstan, Belarus, Georgia, Turkmenistan, Uzbekistan, Armenia, Kyrgyzstan, Moldova, Tajikistan). It then verifies connectivity to the attacker's server over a socket and terminates if the C2 is unreachable, which hampers sandbox and offline analysis. It then performs system reconnaissance, collects data and sends it to the C2. The binary is not obfuscated yet showed a low detection rate at the time.
Data theft scope: browser history, cookies, login data, web data (autofill) and credentials from 95 browsers; 76 cryptocurrency wallets and wallet browser extensions (e.g. MetaMask, Phantom, TronLink) plus registry-resident wallet data (Electrum, Sparrow, Coinomi, Monero, Bitcoin Core); 19 password managers (e.g. 1Password, Bitwarden, LastPass, NordPass, Dashlane) and 2FA extensions; Discord folders, Steam registry data and Telegram Desktop data; miner-related registry entries and installed games; and system metadata (OS build, computer name, CPU, GPU, hardware ID, public IP, RAM, screen resolution) and base64-encoded screenshots.
Attribution: RussianPanda's source code analysis found references to Aurora Stealer, raising the possibility that Aurora's developers are also behind Meduza, although Meduza is written in C++ while Aurora is Go and no Aurora source leak is confirmed. No named threat actor is attributed. Infrastructure research by Vasilis Orlof (Intel Insights) identified 11 C2 servers concentrated in AS210644 (Aeza International) and a distribution server at 89.23.100.74 (AS56694, Smart Ape LLC) hosting resp.exe in an open directory. A BeaconBeagle lookup of sampled C2 IPs (193.3.19.151, 5.252.155.28) returned no match (HTTP 404).
MITRE ATT&CK techniques used in TL-2026-3864
Collection
T1005 Data from Local System; T1113 Screen Capture
Discovery
T1012 Query Registry; T1082 System Information Discovery; T1217 Browser Information Discovery; T1614 System Location Discovery
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers; T1555.005 Password Managers
Resource Development
Affected products and versions in Meduza Stealer
- Microsoft — Windows
Vulnerable versions: Windows (all versions targeted by the C++ stealer) - Various — Web browsers (95), password managers (19), cryptocurrency wallets (76), Discord, Steam, Telegram Desktop
Vulnerable versions: Credential and data stores read from user profile
Remediation for Meduza Stealer
Immediate actions
- Block the listed Meduza C2 and distribution IP addresses at the perimeter and review historical egress logs for connections to them
- Hunt for the listed file hashes and for resp.exe on endpoints
- Reset credentials, revoke session cookies and rotate 2FA/recovery codes for any account whose browser, password manager or Discord/Steam/Telegram data resided on an affected host
- Move cryptocurrency held in wallets on affected hosts to newly generated wallets
Workarounds
- Restrict execution of unsigned executables from user-writable directories
- Avoid storing credentials or seed phrases in browsers or unencrypted local wallet files
Longer-term hardening
- Deploy EDR with behavioral detection for processes reading browser profile stores (Login Data, Cookies, Web Data, logins.json) and wallet paths
- Restrict browser credential storage and enforce hardware-backed MFA to reduce the value of stolen cookies and passwords
- Use the Uptycs-published YARA strings (autofill-profiles.json, logins.json, wallet paths) for retro-hunting
Timeline of Meduza Stealer
- Meduza Stealer first appears on dark web forums (June 2023, per Silent Push; exact day not stated).
- Uptycs publishes its technical analysis of Meduza Stealer, covering geolocation checks, C2 dependency, targeted data and a YARA rule.
- RussianPanda's source code analysis, cited in coverage, finds references to Aurora Stealer, suggesting possible developer overlap.
- Reporting describes Meduza sold on XSS, Exploit.in and Telegram at $199/month, $399/3 months and $1,199 lifetime, with a web panel for data management.
- The Hacker News, Infosecurity Magazine and others report Meduza Stealer targeting 19 password managers, 76 crypto wallets and 95 browsers.
- Nigeria's NCC-CSIRT issues advisory NCC-CSIRT-140723-026 on the Meduza Stealer targeting Windows users.
- Earliest scanned Meduza MaaS web control panels dated to 2023-08-08 (Silent Push).
- Silent Push analysts discover linked Meduza panel infrastructure, later expanded to 100+ panels.
- Operators release a v2.x update via Telegram adding crypto wallet support, bug tracking and expanded exfiltration (Silent Push).
- Silent Push publishes its mapping of 100+ Meduza panels, about a dozen still active, hosted mostly on Aeza.
- Fortinet FortiGuard Labs (Cara Lin) reports Meduza Stealer delivered via a CVE-2024-21412 SmartScreen bypass campaign (LNK, HTA, PowerShell, shellcode injector) against Spain, Thailand and the US, using dead drop resolver C2 techniques.
Sources cited for Meduza Stealer
- Evasive Meduza Stealer Targets 19 Password Managers and 76 Crypto Wallets (The Hacker News)
- What is Meduza Stealer and how does it work (Uptycs)
- Following the Trail - Meduza Stealer (Intel Insights)
- Meduza Stealer Targets Windows Users With Advanced Tactics (Infosecurity Magazine)
- Meduza Stealer Targets Windows Users With Advanced Tactics (Kowatek)
- Novel stealthy Meduza Stealer targeted at Windows systems examined (SC Media)
- MalwareBazaar sample 43b9b71b...de30e4
- MalwareBazaar sample 33a88f11...cde7
- Meduza Stealer: panel infrastructure mapping (Silent Push)
- Microsoft Defender Flaw Exploited to Deliver ACR, Lumma, and Meduza Stealers (The Hacker News)
- NCC-CSIRT Advisory NCC-CSIRT-140723-026: A New Meduza Stealer Malware Targets Windows Users
Detection coverage for TL-2026-3864
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3864 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.