Lumma Stealer Rebuilt Infrastructure After Domain Seizures Disrupted Malware Operation

The U.S. Department of Justice said it seized domains tied to a major information-stealing malware operation involving Lumma Stealer, disrupting command-and-control infrastructure and associated marketplaces. Trend Micro and TrendAI reported that the malware-as-a-service operation suffered a short-lived drop in activity after roughly 2,300 malicious domains were taken down, but victim-account targeting recovered within weeks and returned to typical levels by June and July 2025.

Researchers said Lumma operators quickly adapted by moving infrastructure away from heavy Cloudflare reliance to other providers, including Russia-based Selectel, and by expanding covert delivery methods. Campaigns distributing Lumma used AI-assisted fake GitHub repositories, fake crack and keygen sites, ClickFix fake CAPTCHA lures, and social media promotion to push loaders such as SmartLoader and the stealer itself. TrendAI also cited a developer claim that authorities accessed and wiped servers through a suspected iDRAC vulnerability before the operators restored access and disabled the exposed remote-management interface.