home.social

#stealer — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #stealer, aggregated by home.social.

  1. Brad @[email protected] ·

    2026-01-01 (Thursday): #LummaStealer infection with follow-up malware.

    A #pcap of the infection traffic, the #Lumma #Stealer files, and a list of IOCs are available at malware-traffic-analysis.net/2

    Lumma Stealer C2 domain: offenms[.]cyou

    The follow-up malware is using memory-scanner[.]cc for its C2 traffic, just like I saw on 2025-12-30. But this follow-up malware also used another C2 domain: communicationfirewall-security[.]cc

    #lummastealer #pcap #lumma #stealer
  2. Brad @[email protected] ·

    2026-01-01 (Thursday): #LummaStealer infection with follow-up malware.

    A #pcap of the infection traffic, the #Lumma #Stealer files, and a list of IOCs are available at malware-traffic-analysis.net/2

    Lumma Stealer C2 domain: offenms[.]cyou

    The follow-up malware is using memory-scanner[.]cc for its C2 traffic, just like I saw on 2025-12-30. But this follow-up malware also used another C2 domain: communicationfirewall-security[.]cc

    #lummastealer #pcap #lumma #stealer
  3. Brad @[email protected] ·

    2026-01-01 (Thursday): #LummaStealer infection with follow-up malware.

    A #pcap of the infection traffic, the #Lumma #Stealer files, and a list of IOCs are available at malware-traffic-analysis.net/2

    Lumma Stealer C2 domain: offenms[.]cyou

    The follow-up malware is using memory-scanner[.]cc for its C2 traffic, just like I saw on 2025-12-30. But this follow-up malware also used another C2 domain: communicationfirewall-security[.]cc

    #lummastealer #pcap #lumma #stealer
  4. Brad @[email protected] ·

    2026-01-01 (Thursday): #LummaStealer infection with follow-up malware.

    A #pcap of the infection traffic, the #Lumma #Stealer files, and a list of IOCs are available at malware-traffic-analysis.net/2

    Lumma Stealer C2 domain: offenms[.]cyou

    The follow-up malware is using memory-scanner[.]cc for its C2 traffic, just like I saw on 2025-12-30. But this follow-up malware also used another C2 domain: communicationfirewall-security[.]cc

    #stealer #lumma #pcap #lummastealer
  5. Brad @[email protected] ·

    2026-01-01 (Thursday): #LummaStealer infection with follow-up malware.

    A #pcap of the infection traffic, the #Lumma #Stealer files, and a list of IOCs are available at malware-traffic-analysis.net/2

    Lumma Stealer C2 domain: offenms[.]cyou

    The follow-up malware is using memory-scanner[.]cc for its C2 traffic, just like I saw on 2025-12-30. But this follow-up malware also used another C2 domain: communicationfirewall-security[.]cc

    #lummastealer #pcap #lumma #stealer