# Meduza Stealer: Windows infostealer MaaS with possible Aurora Stealer developer overlap

> Meduza Stealer is a C++ Windows information stealer sold as a subscription service on underground forums and Telegram. It targets 19 password manager applications, 76 cryptocurrency wallets and 95 web browsers, plus Discord and Steam. RussianPanda's source code analysis found references to Aurora Stealer, suggesting possible developer overlap.

- **Published:** 2026-10-19T07:57:27Z
- **Last reviewed:** 2026-10-19T07:57:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3864
- **ID:** TL-2026-3864
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Meduza Stealer is a Windows-based information stealer first publicly documented by Uptycs (blog dated 2023-06-30) and widely reported on 2023-07-03. It is offered as malware-as-a-service on the XSS and Exploit.in underground forums and a Telegram channel at $199/month, $399/3 months or $1,199 lifetime. Subscribers manage their builds and stolen data through a web panel that allows customizing binaries and downloading or deleting exfiltrated data. The seller stated that operations do not involve ransomware activity.

Execution flow described by Uptycs: the sample first checks the victim's geolocation using GetUserGeoID/GetGeoInfoA and aborts if the victim is in an excluded country (CIS states and Turkmenistan: Russia, Kazakhstan, Belarus, Georgia, Turkmenistan, Uzbekistan, Armenia, Kyrgyzstan, Moldova, Tajikistan). It then verifies connectivity to the attacker's server over a socket and terminates if the C2 is unreachable, which hampers sandbox and offline analysis. It then performs system reconnaissance, collects data and sends it to the C2. The binary is not obfuscated yet showed a low detection rate at the time.

Data theft scope: browser history, cookies, login data, web data (autofill) and credentials from 95 browsers; 76 cryptocurrency wallets and wallet browser extensions (e.g. MetaMask, Phantom, TronLink) plus registry-resident wallet data (Electrum, Sparrow, Coinomi, Monero, Bitcoin Core); 19 password managers (e.g. 1Password, Bitwarden, LastPass, NordPass, Dashlane) and 2FA extensions; Discord folders, Steam registry data and Telegram Desktop data; miner-related registry entries and installed games; and system metadata (OS build, computer name, CPU, GPU, hardware ID, public IP, RAM, screen resolution) and base64-encoded screenshots.

Attribution: RussianPanda's source code analysis found references to Aurora Stealer, raising the possibility that Aurora's developers are also behind Meduza, although Meduza is written in C++ while Aurora is Go and no Aurora source leak is confirmed. No named threat actor is attributed. Infrastructure research by Vasilis Orlof (Intel Insights) identified 11 C2 servers concentrated in AS210644 (Aeza International) and a distribution server at 89.23.100.74 (AS56694, Smart Ape LLC) hosting resp.exe in an open directory. A BeaconBeagle lookup of sampled C2 IPs (193.3.19.151, 5.252.155.28) returned no match (HTTP 404).

## MITRE ATT&CK

- T1583.003 Virtual Private Server
- T1555.003 Credentials from Web Browsers
- T1555.005 Password Managers
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1217 Browser Information Discovery
- T1012 Query Registry
- T1005 Data from Local System
- T1113 Screen Capture
- T1608.001 Upload Malware
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1102.001 Dead Drop Resolver

## Sources

- [Evasive Meduza Stealer Targets 19 Password Managers and 76 Crypto Wallets (The Hacker News)](https://thehackernews.com/2023/07/evasive-meduza-stealer-targets-19.html)
- [What is Meduza Stealer and how does it work (Uptycs)](https://www.uptycs.com/blog/what-is-meduza-stealer-and-how-does-it-work)
- [Following the Trail - Meduza Stealer (Intel Insights)](https://intelinsights.substack.com/p/following-the-trail-meduza-stealer)
- [Meduza Stealer Targets Windows Users With Advanced Tactics (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/meduza-stealer-targets-windows/)
- [Meduza Stealer Targets Windows Users With Advanced Tactics (Kowatek)](https://blog.kowatek.com/2023/07/03/meduza-stealer-targets-windows-users-with-advanced-tactics/)
- [Novel stealthy Meduza Stealer targeted at Windows systems examined (SC Media)](https://www.scworld.com/brief/cybercrime/novel-stealthy-meduza-stealer-targeted-at-windows-systems-examined)
- [MalwareBazaar sample 43b9b71b...de30e4](https://bazaar.abuse.ch/sample/43b9b71ba6767fda9748590734a94d570fa2553f8f056ca60e8d96a925de30e4)
- [MalwareBazaar sample 33a88f11...cde7](https://bazaar.abuse.ch/sample/33a88f114a5ebf38ab95567ca6bf3585bbd56946226b7cbd609f73d1540fcde7)
- [Meduza Stealer: panel infrastructure mapping (Silent Push)](https://www.silentpush.com/blog/meduza-stealer/)
- [Microsoft Defender Flaw Exploited to Deliver ACR, Lumma, and Meduza Stealers (The Hacker News)](https://thehackernews.com/2024/07/microsoft-defender-flaw-exploited-to.html)
- [NCC-CSIRT Advisory NCC-CSIRT-140723-026: A New Meduza Stealer Malware Targets Windows Users](https://csirt.ncc.gov.ng/index.php/resources/security-advisories/122-a-new-meduza-stealer-malware-targets-windows-users)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3864