Loading story…
Threat actors distributed LummaStealer through two social-engineering chains that targeted users seeking pirated software or attempting to pass fake verification prompts. One campaign, active since at least December 2024, used GitHub repositories, cracked-software forums, URL shorteners, and posts on platforms including Facebook, Devpost, TikTok, and Chromium issues to push victims toward malicious JavaScript. That script suppressed referrer leakage, captured page-title context, and redirected users through intermediary domains on .cfd, .click, .info, and .xyz before serving password-protected archives from MEGA that extracted a LummaStealer executable.
A separate delivery chain used counterfeit CAPTCHA pages to trick users into opening the Windows Run dialog and pasting a PowerShell command that fetched follow-on instructions from a shortened URL, downloaded a ZIP archive from vultrcdn[.]com, and launched a disguised Setup.exe. The infection sequence relied on legitimate-looking or signed binaries such as a revoked Mergecap.exe, a renamed BtDaemon.exe as StrCmp.exe, more.com, and searchindexer.exe, indicating DLL sideloading and process injection for evasion. Investigators observed outbound traffic to suspicious domains including accentypastedw[.]store and onefreex.com, while analysis of the final payload showed infostealer behavior including scheduled task creation, cryptographic API use, timestamp tampering, and file-permission changes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In May 2025, law enforcement, Microsoft, and private-sector partners disrupted infrastructure associated with the Lumma infostealer operation. The action targeted Lumma's malware-as-a-service ecosystem rather than a specific phishing or cracked-software delivery campaign.
Analysis of the cracked-software LummaStealer campaign found the operators also promoted lures through Facebook groups, Devpost, TikTok, Chromium issues, and other platforms. The activity shared several TTPs with Stargazer Goblin and the Stargazers Ghost Network, though attribution remained uncertain.
A malware campaign active since at least December 2024 distributed LummaStealer by posing as cracked software. It used GitHub repositories, URL shorteners, cracked-software forums, malicious JavaScript redirects, intermediary domains, and MEGA-hosted password-protected archives to deliver the payload.
A phishing campaign used fake CAPTCHA pages to trick users into running a PowerShell command via Win+R and Ctrl+V, which then downloaded and launched Lumma Infostealer through a multi-stage chain using legitimate-looking binaries and likely DLL sideloading/process injection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourcemedium.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple **Lumma Stealer** infection chains that begin with fake CAPTCHA or verification pages and trick Windows users into launching malicious PowerShell from the Run dialog. In one case, victims reached the lure through malicious pop-up ads on a pirated-content site; in another, a page at `you-checked.com` copied a hidden command to the clipboard that fetched follow-on payloads from domains including `ferrydero.com` and `fill-tomap.com`. The malware family, also known as **LummaC2**, is a malware-as-a-service infostealer designed to steal browser data, credentials, cryptocurrency wallets, session tokens, and other sensitive information. The observed chains used `mshta.exe`, obfuscated HTA and JavaScript, layered PowerShell stages, and multiple packed .NET components to retrieve and execute the final payload while evading analysis. Analysts reported AES and XOR decryption, SmartAssembly and .NET Reactor packing, AMSI bypass attempts, anti-sandbox and anti-debugging checks, Windows Defender evasion, and cleanup steps such as deleting downloaded archives after execution. One intrusion created files under `C:\ProgramData`, contacted `iplogger.co`, and launched an infostealer executable named `jegule.exe`, while another sample ultimately communicated through `winhttp.dll` and `ws2_32.dll`; investigators also recovered additional URLs from a Steam Community profile using ROT15 decoding.
Jul 7, 2026
Threat researchers reported renewed activity from **Windows credential-stealing malware** that is designed to evade detection and rapidly scale infections. CYFIRMA described **LTX Stealer** as being delivered via a heavily obfuscated installer that abuses trusted developer and packaging tools—using *Inno Setup* to masquerade as legitimate software, embedding a full **Node.js runtime**, and compiling malicious JavaScript into bytecode to hinder reverse engineering. The installer reportedly contains an unusually large encrypted archive (hundreds of MB) intended to frustrate static scanning, and drops a payload (e.g., `updater.exe`) that functions as the bundled Node.js runtime used to execute the stealer logic. Separately, reporting citing Bitdefender said **Lumma Stealer** has returned “back at scale” after prior law-enforcement disruption of its infrastructure, rebuilding domains and command-and-control capacity to resume widespread credential and data theft. Lumma’s malware-as-a-service ecosystem continues to rely on high-conversion distribution methods, including lure sites offering pirated/cracked content and the **ClickFix** social-engineering technique that tricks users into infecting their own systems, underscoring how infostealer operators are combining resilient infrastructure with user-driven execution to maintain volume despite takedowns.
Jun 29, 2026
Trend Micro reported that the **Lumma Stealer** malware was being delivered through Discord’s content delivery network, using trusted infrastructure to host and spread credential-theft payloads. The campaign abused Discord CDN links to make malicious downloads appear legitimate, increasing the likelihood that users would execute the malware and allowing attackers to bypass some reputation-based defenses. Once installed, Lumma Stealer was positioned to harvest sensitive data from infected systems, including credentials and other information valuable for follow-on fraud or intrusion activity. The use of a widely trusted platform for malware hosting highlights how threat actors continue to blend malicious payload delivery into legitimate cloud and social platforms, complicating detection and response for enterprise defenders.
Jul 12, 2026