Lumar
Lumar, also referred to as PovertyStealer, is an infostealer malware family. The provided content associates it with theft of Chrome cookies and other browser secrets and states that it successfully bypassed Google Chrome’s App-Bound Encryption (ABE), a protection introduced in Chrome 127 on Windows to better secure cookies and stored credentials. According to the content, Lumar initially addressed ABE with a temporary approach that required the malware to be launched with administrator rights, then later implemented a bypass that worked with the privileges of the logged-in user. The exact technical bypass method is not disclosed in the provided material. The content also places Lumar among multiple stealer families that continued harvesting Chrome data after ABE was introduced.
Operationally, the content describes Lumar as an infostealer used by a traffer team for infections during a broader malware distribution operation active from June 2023 through early September 2023. SpyCloud Labs confirmed the team used Lumar, but reported no public stats panel, campaign spreadsheets, or additional campaign details for this malware family. No specific threat actor attribution beyond that usage context, no industry-specific targeting, and no concrete indicators of compromise are provided in the source material.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
In this scheme, victims click a software download button on a site claiming to provide access to a sought-after program, and thereafter are redirected through a variety of websites (many ending in *.click or *.xyz), before eventually being presented with a file to download, which contains the malware.
Execution
1 technique
Execution
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
1 technique
Stealth
Credential Access
3 techniques
Credential Access
This model does not allow infostealer malware, which runs with the permissions of the logged user, to steal secrets stored in Chrome browser.
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
Other indicator types observed in public reporting.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An infostealer mentioned as one of the malware families whose developers claimed to have bypassed Chrome’s App-Bound Encryption.
An infostealer referenced as continuing to steal Chrome cookie data and other secrets despite App-Bound Encryption protections.
Инфостилер, также известный как PovertyStealer; упомянут среди семейств, заявлявших об обходе Chrome Application-Bound Encryption.
Identified as one of multiple malware families reported to have successfully bypassed App-Bound Encryption.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.