Doenerium

Doenerium is an information stealer malware family. Microsoft Threat Intelligence linked it to a large December 2024 malvertising campaign that originated from illegal streaming and pirated-content sites, where redirectors embedded in video frames funneled users through multiple hops to GitHub-hosted payloads delivering stealers including Doenerium and Lumma. Microsoft reported the campaign affected nearly 1 million devices, including both consumer and enterprise systems, and that infections could begin from simple interaction with play or unmute buttons without an explicit download prompt or credential entry. Microsoft Defender Experts also reported overlap between payloads in this campaign and the Doenerium malware family based on binary properties and dropped components such as DLLs and HTML, and noted that Doenerium-like payloads used command-and-control infrastructure historically associated with Lumma Stealer. Separate reporting cited Doenerium as an example of an infostealer built and distributed using Electron. High-confidence context in the source material identifies Doenerium primarily as an infostealer associated with GitHub-hosted delivery, malvertising redirect chains, and illegal streaming-site infection vectors.