Resurgence of Windows infostealers using stealth packaging and social-engineering lures

Threat researchers reported renewed activity from Windows credential-stealing malware that is designed to evade detection and rapidly scale infections. CYFIRMA described LTX Stealer as being delivered via a heavily obfuscated installer that abuses trusted developer and packaging tools—using Inno Setup to masquerade as legitimate software, embedding a full Node.js runtime, and compiling malicious JavaScript into bytecode to hinder reverse engineering. The installer reportedly contains an unusually large encrypted archive (hundreds of MB) intended to frustrate static scanning, and drops a payload (e.g., updater.exe) that functions as the bundled Node.js runtime used to execute the stealer logic.

Separately, reporting citing Bitdefender said Lumma Stealer has returned “back at scale” after prior law-enforcement disruption of its infrastructure, rebuilding domains and command-and-control capacity to resume widespread credential and data theft. Lumma’s malware-as-a-service ecosystem continues to rely on high-conversion distribution methods, including lure sites offering pirated/cracked content and the ClickFix social-engineering technique that tricks users into infecting their own systems, underscoring how infostealer operators are combining resilient infrastructure with user-driven execution to maintain volume despite takedowns.