Live and recent posts from across the Fediverse tagged #lummastealer, aggregated by home.social.
EU, UK sanction Russian cyberespionage networks over destructive attacks
European governments sanctioned Russian individuals and organizations Monday over what they said was a years-long campaign of cyberespionage…
#Europe #EU #Austria #cyberespionage #Cyprus #Energy #EuropeanUnion #Finland #fsb #Germany #gru #lummastealer #Netherlands #Poland #Romania #Russia #secretblizzard #Slovakia #turla #unitedkingdom(u.k.)
https://www.europesays.com/europe/93170/
EU, UK sanction Russian cyberespionage networks over destructive attacks
European governments sanctioned Russian individuals and organizations Monday over what they said was a years-long campaign of cyberespionage…
#EuropeSays #Russia #Austria #cyberespionage #Cyprus #Energy #EuropeanUnion #Finland #FSB #Germany #gru #lummastealer #Netherlands #Poland #Romania #secretblizzard #Slovakia #turla #unitedkingdom(u.k.)
https://www.europesays.com/russia/39406/
EU, UK sanction Russian cyberespionage networks over destructive attacks https://www.byteseu.com/2192247/ #Austria #cyberespionage #Cyprus #Energy #EuropeanUnion #Finland #FSB #Germany #GreatBritain #GRU #LummaStealer #Netherlands #Poland #Romania #Russia #SecretBlizzard #Slovakia #turla #UnitedKingdom #UnitedKingdom(uK)
Microsoft Utility MSHTA Fuels Malware Surge via Lumma Stealer Campaigns
Malware campaigns are on the rise, fueled by the Microsoft Utility MSHTA, which is being exploited to spread info stealers like Lumma Stealer and Amatera. This sneaky tactic is just the latest example of how cybercriminals are abusing a long-standing Windows feature to wreak havoc.
Vercel Breach Exposes Additional Customer Accounts
A recent Vercel breach exposed additional customer accounts after a malicious chain of events began with a compromised employee account at Context.ai, which was likely triggered by a simple online search for Roblox scripts. The breach highlights the risks of malware distribution and token theft, with threat intel pointing to a sophisticated…
#VercelBreach #EmergingThreats #SupplyChain #MalwareOperations #LummaStealer
Dal Roblox script al breach di Vercel: come un infostealer ha quasi compromesso la supply chain di Next.js
Un dipendente di Context.ai infettato da Lumma Stealer tramite script Roblox ha aperto la porta a una potenziale supply chain attack su Vercel e Next.js. ShinyHunters rivendica il furto di codice sorgente, token NPM/GitHub e 580 record di dipendenti, offrendo il pacchetto per $2 milioni. Vercel conferma accesso limitato ma esclude compromissione dei framework open source.
ISC Diary: #LummaStealer infection with #SectopRAT (#ArechClient2) https://isc.sans.edu/diary/32904
Nowy wariant metody ClickFix – cyberprzestępcy rezygnują z Win+R na rzecz Win+X i Terminala Windows
Badacze bezpieczeństwa z Microsoft Defender ostrzegają przed nowym wariantem kampanii malware, w której cyberprzestępcy za pomocą phishingu nakłaniają użytkowników do instalacji złośliwego oprogramowania typu infostealer (Lumma Stealer). Atak opiera się na technice ClickFix, polegającej na przekonaniu użytkownika do uruchomienia złośliwych poleceń PowerShell.TLDR: Schemat ataku jest dosyć prosty. Korzystając z socjotechniki...
#Aktualności #Clickfix #LummaStealer #Microsoft #Windows #WindowsDefender
CTM360 identifies an active campaign leveraging Google Groups and Google-hosted redirect chains to deliver Lumma Stealer (Windows) and a trojanized Chromium fork branded “Ninja Browser” (Linux).
Technical highlights:
• 950MB padded executable (null-byte inflation)
• AutoIt loader reconstruction
• Memory-resident payload execution
• Multipart/form-data POST exfiltration
• Malicious extension “NinjaBrowserMonetisation”
• XOR + Base56-like JS obfuscation
• Scheduled task persistence
• Russian search engine default modification
This campaign reinforces a critical shift: SaaS platforms are now delivery infrastructure.
Defensive priorities:
– IoC blocking at firewall + EDR
– Redirect chain inspection
– Extension audit controls
– Endpoint scheduled task monitoring
How are you adjusting detection engineering for SaaS-based malware distribution?
Engage below.
Source: https://www.ctm360.com/reports/ninja-browser-lumma-infostealer
Follow @technadu for ongoing threat intelligence coverage.
#ThreatIntel #MalwareResearch #DetectionEngineering #SOCOperations #EDR #CloudSecurity #SaaSAbuse #LummaStealer #LinuxThreats #CTM360 #IncidentResponse
DNS-based staging via ClickFix represents tactical evolution.
Per Microsoft:
• Cmd.exe → nslookup execution
• Hardcoded external DNS resolver
• Payload embedded in DNS Name: response
• ZIP retrieval from azwsappdev[.]com
• Python-based reconnaissance
• VBScript persistence via Startup LNK
• ModeloRAT deployment
• Lumma Stealer distribution via CastleLoader (GrayBravo)
Campaign telemetry also discussed by Bitdefender and Kaspersky.
DNS offers:
• Reduced dependency on HTTP
• Traffic blending with legitimate queries
• Lightweight validation signaling
Detection priorities:
• Anomalous nslookup patterns
• External DNS resolver usage
• Suspicious Startup LNK creation
• DNS response content inspection
Is your EDR correlating DNS queries with process lineage?
Engage below.
Follow @technadu for advanced threat analysis.
#ThreatIntel #ClickFix #DNSStaging #ModeloRAT #LummaStealer #CastleLoader #DetectionEngineering #BlueTeam #SOC #Infosec #CyberOperations #MalwareAnalysis
LummaStealer Is Getting a Second Life Alongside CastleLoader
#LummaStealer #CastleLoader
https://www.bitdefender.com/en-us/blog/labs/lummastealer-second-life-castleloader
Compromise Report 2026 de Lumu revela un giro hacia ciberataques más silenciosos y persistentes
Compromise Report 2026 de Lumu revela un giro hacia ciberataques más silenciosos y persistentes
San José, 10 feb (elmundo.cr) – Lumu Technologies, la compañía de ciberseguridad pionera en el modelo de Continuous Compromise Assessment®, presentó hoy su informe Compromise [...]
#Ciberataques #CienciaYTecnología #CompromiseReport2026 #DeathRansom #LummaStealer #LumuTechnologies
2026-02-01 (Sunday): It's easy enough to find #LummaStealer malware samples.
Just do a Google search for cracked versions of popular software and specify site:drive.google.com.
Details on today's haul at https://github.com/malware-traffic/indicators/blob/main/2026-02-01-Google-Drive-links-lead-to-Lumma-Stealer.txt
2026-01-22 (Thursday): #RemcosRAT infection persistent on an infected Windows host. This was caused by #ClickFix instructions from #SmartApeSG through a fake CAPTCHA page. Details of this #Remcos #RAT infection are available at https://www.malware-traffic-analysis.net/2026/01/06/index.html
I've also added three other blog entries from infections I generated in my lab on Tuesday, 2026-01-20. Those can be found at https://www.malware-traffic-analysis.net/2026/index.html
Those three other entries cover #LummaStealer, #VIPRecovery, and #Xworm. The VIP Recovery and Xworm infections followed the same chain of events, which includes #steganography through base64 text embedded in an image.
Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain
#LummaStealer
https://isc.sans.edu/diary/32628
2026-01-01 (Thursday): #LummaStealer infection with follow-up malware.
A #pcap of the infection traffic, the #Lumma #Stealer files, and a list of IOCs are available at https://www.malware-traffic-analysis.net/2026/01/01/index.html
Lumma Stealer C2 domain: offenms[.]cyou
The follow-up malware is using memory-scanner[.]cc for its C2 traffic, just like I saw on 2025-12-30. But this follow-up malware also used another C2 domain: communicationfirewall-security[.]cc
2025-12-30 (Tuesday): #LummaStealer infection with follow-up malware.
A #pcap of the infection traffic, the associated #Lumma with follow-up #malware samples, and some IOCs are available at www.malware-traffic-analysis.net/2025/12/30/index.html
I don't know what the follow-up malware is, but unlike Lumma Stealer, the follow-up malware was made persistent.
Big thanks to VirusTotal on this, because I was able to grab VirusTotal's CAPE Sandbox analysis of the Lumma Stealer sample, and it shows the URLs from the HTTPS traffic that I can't get in my lab.
If anyone knows what the follow-up malware is, please share that info!
Top 3 Malware Families in Q4: How to Keep Your SOC Ready https://hackread.com/top-3-malware-families-in-q4-how-to-keep-your-soc-ready/ #ThreatIntelligence #Cybersecurity #Vulnerability #LummaStealer #AgentTesla #Security #Malware #ANYRUN #XWorm #SOC
Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics
#LummaStealer #WaterKurita
https://www.trendmicro.com/en_us/research/25/k/lumma-stealer-browser-fingerprinting.html
Philippines among Top 20 countries most targeted by cyberattacks in 2025
Y en un giro de los acontecimientos, un grupo rival (de infostealer presumiblemente) ataca y expone a la luz las identidades y detalles de los miembros de #Lumma, con información tan sensible como datos bancarios o número de pasaporte. Esto se une al compromiso de las cuentas de Telegram del grupo criminal. Esto, claro, ha provocado el éxodo de clientes a plataformas de malware as a service alternativas. Y yo viendo esto con palomitas.
Ahora me explico la caída en picado en la actividad de Lumma.
I've considered deploying more HTTP-referrer based URL-policies. In particular, links from social platforms' comments: YouTube, GitHub Issues, Reddit, Instagram, etc.
I have a lookup in my SIEM to flag traffic referred from a comment. But it's probably time to shift-to-protect.
Anyone else done this in their SASE/proxy? I think it's already common in education.
And we're at the mercy of these platforms' URL params. So I'd need some observability on the pattern matching.
Compromised YouTube Accounts Used to Distribute Infostealer Malware https://thecyberexpress.com/compromised-youtube-accounts-infostealer-malware/ #Rhadamanthysstealer #TheCyberExpressNews #StealCinfostealer #TheCyberExpress #RedLineStealer #YouTubemalware #FirewallDaily #LummaStealer #infostealer #CyberNews #malware
Rival Hackers Dox Alleged Operators of Lumma Stealer https://hackread.com/rival-hackers-dox-lumma-stealer-operators/ #Cybersecurity #LummaStealer #Infostealer #CyberCrime #LummaRats #Security #Malware
Cybercriminals turn on each other: the story of Lumma Stealer’s collapse https://www.fortra.com/blog/cybercriminals-turn-each-other-story-lumma-stealers-collapse #LummaStealer #Guestblog #Malware #doxxing
Rival hackers have doxxed the alleged operators behind #LummaStealer, one of the biggest data-theft malware services. The leaks have caused internal chaos and slowed its growth.
Read: https://hackread.com/rival-hackers-dox-lumma-stealer-operators/
RE: https://infosec.exchange/@patrickcmiller/115414802165768074
For those interested in the doxxing published on website named ‘Lumma Rats, here's the site:
lummakrysy[.]rip
Lumma Stealer Slowed by Doxxing Campaign https://thecyberexpress.com/lumma-stealer-doxxing-campaign/ #TheCyberExpressNews #RedlineInfostealer #ThreatIntelligence #CredentialAttacks #StealCinfostealer #VidarInfostealer #TheCyberExpress #FirewallDaily #cybersecurity #CyberThreats #LummaStealer #infostealer #cybercrime #CyberNews #AmadeyBot #Dataleak #darkweb
Lumma Stealer Activity Drops After Doxxing https://www.securityweek.com/lumma-stealer-activity-drops-after-doxxing/ #Malware&Threats #LummaStealer #infostealer #disrupted
🚨 Cyber Threat Update: Lumma Stealer Doxxing
A targeted underground exposure campaign impacted Lumma Stealer (Water Kurita) operators, causing:
- 🔻 Reduced malware activity
- 🔄 Customer migration to Vidar, StealC, Amadey
- ⚔️ Intensified competition among infostealer MaaS platforms
What’s your take - is this a turning point for underground malware markets?
💬 Join the conversation & follow TechNadu for actionable cyber intelligence.
#CyberSecurity #Infostealer #LummaStealer #WaterKurita #Malware #MaaS #ThreatIntel #Vidar #StealC #Amadey #DarkWeb #CyberCrime #TechNadu #CyberUpdate
Shifts in the Underground: The Impact of Water Kurita’s (Lumma Stealer) Doxxing
#WaterKurita #LummaStealer
https://www.trendmicro.com/en_us/research/25/j/the-impact-of-water-kurita-lumma-stealer-doxxing.html
2025-10-01 (Wednesday) I've posted #malware samples and a #pcap of the post-infection traffic from an infection by possible #Rhadamanthys malware at https://www.malware-traffic-analysis.net/2025/10/01/index.html
This is from a campaign that disguises files as cracked versions of popular software
I usually see #LummaStealer from this, but lately, it's been Rhadamanthys.
2025-09-24 (Wednesday): #LummaStealer infection with follow-up malware, possibly #Ghostsocks or #GoBackdoor.
A #pcap of the infection traffic, malware samples, and list of indicators are available at https://www.malware-traffic-analysis.net/2025/09/24/index.html
Unveiling LummaStealer’s Technical Details Through ML-Based Detection Approach https://gbhackers.com/lummastealers-details/ #CyberSecurityNews #cybersecurity #LummaStealer
2025-09-03 (Wednesday): #Kongtuke injected script leads to fake CAPTCHA page.
The fake CAPTCHA page provides #ClickFix style instructions to run a malicious command/script for #LummaStealer
Clipboard hijacking (pastejacking) at its finest!
A #pcap of the infection traffic, the associated malware, and a list of indicators are at https://www.malware-traffic-analysis.net/2025/09/03/index.html
Since end of August we observe infamous #LummaStealer communicating with DGA-like domain names 🤖👀, for example ⤵️
oneflof .ru
georgej .ru
bastxtu .top
larpfxs .top
...
We have seen such domains across 3 distinct IP address, all sharing the same SSL certificate
(SHA1 fingerprint: 497f2c84c223602794cbe4481e2641bdb55d81a7):
129.226.128.168:443 (Tencent 🇨🇳)
31.220.109.219:443 (Hostinger 🇺🇸)
165.227.143.219:443 (DigitalOcean🇺🇸)
Malware sample:
📄https://bazaar.abuse.ch/sample/df0442cb22d02ff079e06ffaf287eebe2fbefe5744ebe428e4436589facca3fe/
Recent DTI research tracked a trojan using hosted PowerShell scripts, uncovering bulletproof hosting services and how #LummaStealer remains a threat.
Read the full report: https://dti.domaintools.com/hunting-for-malware-networks/
2025-08-15 (Friday): Here are some images from a post I wrote for my employer on other social media platforms.
This is from a #LummaStealer infection that led to #SectopRAT (#ArechClient2).
A #pcap of the infection traffc, along with the associated #malware and artifacts are available at https://www.malware-traffic-analysis.net/2025/08/15/index.html
2025-08-13 (Wednesday): #LummaStealer infection. The associated #malware, artifacts, a #pcap of the #Lumma Stealer traffic, and indicators of compromise are available at https://www.malware-traffic-analysis.net/2025/08/13/index.html