Water Kurita

Water Kurita, also tracked as Storm-2477, is a financially motivated cybercriminal operation associated with the development and provision of Lumma Stealer as malware-as-a-service. Lumma Stealer, also known as LummaC2, has been marketed on underground forums since 2022. Its customers use the malware to collect login credentials, browser information, cryptocurrency-wallet data, two-factor authentication extension data, financial information, and other sensitive personal information for exfiltration. The operation's distribution ecosystem uses fake software cracks, key generators, game cheats, cryptocurrency utilities, malicious GitHub repositories, malvertising, search-engine manipulation, and social-media promotions. ClickFix delivery chains use fake CAPTCHA prompts to persuade victims to execute malicious PowerShell commands. Associated GitHub campaigns use convincing, sometimes AI-generated documentation to direct users to malicious releases. These infection chains employ legitimate Lua components, obfuscated scripts, SmartLoader, and encrypted AutoIt stages to deliver Lumma Stealer. Lumma Stealer employs remote-thread injection into legitimate Chrome processes, security-software discovery, and browser fingerprinting to support reconnaissance and defense evasion. Its fingerprinting collects host characteristics, browser metadata, graphics and audio properties, and network information. The operation has also deployed GhostSocks as a secondary payload. An international law-enforcement operation disrupted Lumma Stealer infrastructure in May 2025, but activity recovered within weeks. A further decline occurred in September 2025, followed by renewed activity beginning in late October. The operators have demonstrated resilience through infrastructure rebuilding, hosting-provider diversification, and continued malware updates.