Loading story…
Rival cybercriminals launched a doxxing campaign against the alleged operators of Lumma Stealer, a prominent Malware-as-a-Service platform used to steal credentials, financial data, and crypto wallets. Sensitive personal and operational details of five individuals associated with Lumma Stealer were published online, including passport numbers and financial records, following a failed law enforcement takedown attempt earlier in the year. The campaign, which intensified between late August and early October 2025, also resulted in the compromise of the group’s official Telegram accounts, severely disrupting their communications and operations.
This exposure led to a significant drop in Lumma Stealer’s activity, creating a vacuum in the infostealer market. As Lumma Stealer’s presence waned, threat actors began adopting alternatives such as Vidar Stealer 2.0, which was released with enhanced capabilities and a complete code rewrite. The shift in the cybercriminal ecosystem highlights how internal rivalries and operational disruptions can rapidly alter the landscape of malware distribution and adoption.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Hackread published a report stating that rival hackers had doxed alleged operators of the Lumma Stealer malware. The reference marks a public disclosure of claimed attribution-related information about the operators.
Trend Micro released research describing 'Vidar Stealer 2.0' and its upgraded infostealer capabilities. The reference indicates public disclosure of technical details about the malware's speed, breadth, and evasiveness.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported sustained infostealer activity centered on **Lumma Stealer** and **Vidar**, with operators distributing malware through fake CAPTCHA lures, pirated software downloads, phishing emails, and poisoned search results. AhnLab said July 2026 campaigns commonly delivered **Remus, LummaC2, ACRStealer, and Vidar** via cracked software hosted on services including **mega.nz**, **Amazon S3**, and **MediaFire**, while Microsoft and other well-known brands were frequently impersonated. TrendAI separately described fake verification pages that trick victims into pasting malicious commands into the Windows Run dialog, leading to multistage infections that deployed **Lumma Stealer, Rhadamanthys, AsyncRAT, XWorm,** and **Emmenhtal**. The campaigns relied on evasive execution chains using `mshta.exe`, obfuscated PowerShell, DLL sideloading, temporary Chromium profiles, and even MP3 files carrying injected JavaScript to load payloads in memory and communicate with attacker-controlled infrastructure. Researchers also said **Vidar Stealer 2.0** expanded its appeal with a rewritten codebase, multithreaded theft, stronger anti-analysis, and broader credential and wallet theft, helping it gain momentum as some criminals moved away from Lumma after a doxxing incident and Telegram account compromise disrupted Lumma operations and eroded trust in its malware-as-a-service ecosystem. The reporting indicates that infostealer operators are rapidly shifting delivery methods and malware families while continuing to target both enterprises and individual users for credential theft and follow-on attacks.
Aug 21, 2026
The U.S. Department of Justice said it seized domains tied to a major information-stealing malware operation involving **Lumma Stealer**, disrupting command-and-control infrastructure and associated marketplaces. Trend Micro and TrendAI reported that the malware-as-a-service operation suffered a short-lived drop in activity after roughly **2,300 malicious domains** were taken down, but victim-account targeting recovered within weeks and returned to typical levels by June and July 2025. Researchers said Lumma operators quickly adapted by moving infrastructure away from heavy **Cloudflare** reliance to other providers, including Russia-based **Selectel**, and by expanding covert delivery methods. Campaigns distributing Lumma used **AI-assisted fake GitHub repositories**, fake crack and keygen sites, **ClickFix** fake CAPTCHA lures, and social media promotion to push loaders such as **SmartLoader** and the stealer itself. TrendAI also cited a developer claim that authorities accessed and wiped servers through a suspected **iDRAC** vulnerability before the operators restored access and disabled the exposed remote-management interface.
Aug 21, 2026
**Lumma Stealer** continued to expand as a prolific malware-as-a-service infostealer, with researchers reporting sharp growth in detections and increasingly diverse delivery chains. Microsoft attributed the malware and its command-and-control ecosystem to **Storm-2477**, which operates Lumma for affiliates that build payloads and run campaigns through a management panel. ESET reported Lumma detections surged **369%** in late 2024, while additional reporting from Netskope and other researchers highlighted ongoing **fake CAPTCHA/ClickFix** lures and fresh payload variants designed to evade detection. Observed campaigns used multiple infection paths, including phishing, malvertising, compromised websites, trojanized software, abuse of trusted platforms such as GitHub, and delivery by other malware including **DanaBot**. Microsoft described an early-April campaign that combined **EtherHiding** hosted through Binance Smart Chain smart contracts with ClickFix social engineering, and an April 7 campaign targeting Canadian organizations that used **Prometheus TDS** redirection plus `mshta` and PowerShell stages to deploy Lumma alongside **Xworm**. The malware was reported stealing credentials and cryptocurrency wallets, using process injection and hollowing, and relying on layered infrastructure with hardcoded domains and fallback channels through **Steam** and **Telegram** behind Cloudflare; Microsoft said its disruption effort led to the takedown, suspension, or blocking of about **2,300 malicious domains** tied to Lumma operations.
Aug 15, 2026