Loading story…
Security researchers reported a sharp rise in the Rugmi malware loader, tracked by ESET as Win/TrojanDownloader.Rugmi, after detections jumped from single digits to hundreds per day. Rugmi has been used to deliver multiple information stealers, including Lumma Stealer, Vidar, RecordBreaker, and Rescoms. Analysts said the malware appears in several forms: a downloader that fetches an encrypted payload, a loader that executes a payload embedded in its own resources, and a variant that launches a payload from an external disk file.
The activity reflects a broader criminal ecosystem built around commodity malware delivery and remote access abuse. Researchers noted that Lumma Stealer is sold through a malware-as-a-service model and is distributed through malvertising, fake browser updates, cracked software installers, and abuse of Discord CDN infrastructure. Separately, McAfee detailed how attackers have repurposed the legitimate NetSupport remote administration tool as a RAT, with initial access brokers using it against targets in the U.S. and Canada to establish footholds for follow-on compromise.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
ESET telemetry showed Rugmi detections continued at sharply elevated levels in November 2023, with hundreds of daily detections. The loader's activity reflected broader use of ready-made malware services to distribute commodity stealers.
ESET telemetry showed detections of the Rugmi malware loader surged in October 2023, rising from single-digit daily detections toward hundreds per day. Rugmi was observed delivering multiple stealers including Lumma, Vidar, RecordBreaker, and Rescoms.
Trend Micro revealed that Discord's content delivery network was being used to host and propagate Lumma Stealer. The campaign used random and compromised Discord accounts to send direct messages offering money or Discord Nitro and directing targets to a malicious executable masquerading as iMagic Inventory.
ESET published details on the Rugmi malware loader in its Threat Report H2 2023, describing three component types: a downloader that retrieves an encrypted payload, a loader that executes a payload from internal resources, and a loader that runs a payload from an external disk file.
McAfee Labs disclosed a new variant of NetSupport RAT being used by initial access brokers against targets in the U.S. and Canada. The company said the infection chain starts with obfuscated JavaScript that launches PowerShell to retrieve remote-control and stealer malware from an actor-controlled server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported sustained infostealer activity centered on **Lumma Stealer** and **Vidar**, with operators distributing malware through fake CAPTCHA lures, pirated software downloads, phishing emails, and poisoned search results. AhnLab said July 2026 campaigns commonly delivered **Remus, LummaC2, ACRStealer, and Vidar** via cracked software hosted on services including **mega.nz**, **Amazon S3**, and **MediaFire**, while Microsoft and other well-known brands were frequently impersonated. TrendAI separately described fake verification pages that trick victims into pasting malicious commands into the Windows Run dialog, leading to multistage infections that deployed **Lumma Stealer, Rhadamanthys, AsyncRAT, XWorm,** and **Emmenhtal**. The campaigns relied on evasive execution chains using `mshta.exe`, obfuscated PowerShell, DLL sideloading, temporary Chromium profiles, and even MP3 files carrying injected JavaScript to load payloads in memory and communicate with attacker-controlled infrastructure. Researchers also said **Vidar Stealer 2.0** expanded its appeal with a rewritten codebase, multithreaded theft, stronger anti-analysis, and broader credential and wallet theft, helping it gain momentum as some criminals moved away from Lumma after a doxxing incident and Telegram account compromise disrupted Lumma operations and eroded trust in its malware-as-a-service ecosystem. The reporting indicates that infostealer operators are rapidly shifting delivery methods and malware families while continuing to target both enterprises and individual users for credential theft and follow-on attacks.
Aug 21, 2026
Researchers tied **ResolverRAT**, **LummaStealer**, and an **Amadey** botnet cluster to an active financially motivated campaign that has operated since at least late 2025 and uses fake browser update lures, staged loaders, and legitimate remote management tools for persistence. One analyzed chain used a Donut-decrypted, triple-protected `.NET` loader to deliver both ResolverRAT and LummaStealer at once, combining persistent remote access with credential and cryptocurrency wallet theft. The malware used layered obfuscation including .NET Reactor, custom transformations, AES-256-CBC, GZip, process hollowing, fragmented WinAPI reconstruction, forged compile timestamps, encrypted resource blobs, and certificate pinning, while operators rotated infrastructure across dozens of IPs, multiple domains, and hosting providers in Russia, the Netherlands, Germany, Poland, and elsewhere. Investigators also identified a fake Microsoft-themed domain, **pat[.]microsoft-telemetry[.]at**, and newly activated infrastructure such as **kampf[.]huehnchenfarm[.]ru** tied to the same ecosystem. A parallel March 2026 investigation linked the **fbf543** Amadey campaign to more than 50 payloads spanning at least 13 malware families, including Vidar, QuasarRAT, XWorm, AsyncRAT, Smoke Loader, and LummaStealer, with delivery through fake installers and hosting on infrastructure centered on **Omegatech LTD (AS202412)** and related abusive networks. Analysts found that the operators also abused nine legitimate, signed RMM tools from **ConnectWise, DattoRMM, Atera, GoToResolve, and N-able**, configuring them to beacon to attacker-controlled relays rather than compromising the vendors themselves. A separate Go-based loader unpacked LummaStealer with AES, RC4, and QuickLZ before hollowing **AppLaunch.exe**, reinforcing a playbook built around stealthy loaders, infostealer deployment, redundant access channels, and monetization consistent with an initial access broker or ransomware affiliate operation.
Jun 29, 2026
**Lumma Stealer** continued to expand as a prolific malware-as-a-service infostealer, with researchers reporting sharp growth in detections and increasingly diverse delivery chains. Microsoft attributed the malware and its command-and-control ecosystem to **Storm-2477**, which operates Lumma for affiliates that build payloads and run campaigns through a management panel. ESET reported Lumma detections surged **369%** in late 2024, while additional reporting from Netskope and other researchers highlighted ongoing **fake CAPTCHA/ClickFix** lures and fresh payload variants designed to evade detection. Observed campaigns used multiple infection paths, including phishing, malvertising, compromised websites, trojanized software, abuse of trusted platforms such as GitHub, and delivery by other malware including **DanaBot**. Microsoft described an early-April campaign that combined **EtherHiding** hosted through Binance Smart Chain smart contracts with ClickFix social engineering, and an April 7 campaign targeting Canadian organizations that used **Prometheus TDS** redirection plus `mshta` and PowerShell stages to deploy Lumma alongside **Xworm**. The malware was reported stealing credentials and cryptocurrency wallets, using process injection and hollowing, and relying on layered infrastructure with hardcoded domains and fallback channels through **Steam** and **Telegram** behind Cloudflare; Microsoft said its disruption effort led to the takedown, suspension, or blocking of about **2,300 malicious domains** tied to Lumma operations.
Aug 15, 2026