#lumma — Public Fediverse posts

2026-01-01 (Thursday): #LummaStealer infection with follow-up malware.

A #pcap of the infection traffic, the #Lumma #Stealer files, and a list of IOCs are available at https://www.malware-traffic-analysis.net/2026/01/01/index.html

Lumma Stealer C2 domain: offenms[.]cyou

The follow-up malware is using memory-scanner[.]cc for its C2 traffic, just like I saw on 2025-12-30. But this follow-up malware also used another C2 domain: communicationfirewall-security[.]cc

2025-12-30 (Tuesday): #LummaStealer infection with follow-up malware.

A #pcap of the infection traffic, the associated #Lumma with follow-up #malware samples, and some IOCs are available at www.malware-traffic-analysis.net/2025/12/30/index.html

I don't know what the follow-up malware is, but unlike Lumma Stealer, the follow-up malware was made persistent.

Big thanks to VirusTotal on this, because I was able to grab VirusTotal's CAPE Sandbox analysis of the Lumma Stealer sample, and it shows the URLs from the HTTPS traffic that I can't get in my lab.

If anyone knows what the follow-up malware is, please share that info!

Y en un giro de los acontecimientos, un grupo rival (de infostealer presumiblemente) ataca y expone a la luz las identidades y detalles de los miembros de #Lumma, con información tan sensible como datos bancarios o número de pasaporte. Esto se une al compromiso de las cuentas de Telegram del grupo criminal. Esto, claro, ha provocado el éxodo de clientes a plataformas de malware as a service alternativas. Y yo viendo esto con palomitas.

Ahora me explico la caída en picado en la actividad de Lumma.

#lummastealer #ciberseguridad #cybersecurity

RE: https://infosec.exchange/@patrickcmiller/115414802165768074

For those interested in the doxxing published on website named ‘Lumma Rats, here's the site:

lummakrysy[.]rip

#lumma #LummaStealer #doxxing #threatintel

網路捷徑檔案安全機制繞過漏洞遭到利用超過一年，攻擊者用於散布數種竊資軟體 | iThome

Link