A new report details the inner workings of a highly evasive loader that's used to deliver the Aurora information stealer malware. The loader, which is compiled with Embarcadero RAD Studio, is designed to query the vendor ID of the graphics card installed on a system. If the value doesn't match, the loader terminates itself. The loader ultimately decrypts the final payload and injects it into a legitimate process called "sihost.exe" using a technique called process hollowing. Alternatively, some loader samples also allocate memory to write the decrypted payload and invoke it from there. Aurora is a Go-based information stealer that emerged on the threat landscape in late 2022. Offered as a commodity malware to other actors, it's distributed through YouTube videos and SEO-poised fake cracked software download websites. Clicking the links present in YouTube video descriptions redirects the victim to decoy websites where they are enticed into downloading the malware under the garb of a seemingly-legitimate utility.