Loading story…
The U.S. Department of Justice said it seized domains tied to a major information-stealing malware operation involving Lumma Stealer, disrupting command-and-control infrastructure and associated marketplaces. Trend Micro and TrendAI reported that the malware-as-a-service operation suffered a short-lived drop in activity after roughly 2,300 malicious domains were taken down, but victim-account targeting recovered within weeks and returned to typical levels by June and July 2025.
Researchers said Lumma operators quickly adapted by moving infrastructure away from heavy Cloudflare reliance to other providers, including Russia-based Selectel, and by expanding covert delivery methods. Campaigns distributing Lumma used AI-assisted fake GitHub repositories, fake crack and keygen sites, ClickFix fake CAPTCHA lures, and social media promotion to push loaders such as SmartLoader and the stealer itself. TrendAI also cited a developer claim that authorities accessed and wiped servers through a suspected iDRAC vulnerability before the operators restored access and disabled the exposed remote-management interface.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
Trend Micro observed the number of accounts targeted by Lumma Stealer steadily returning to typical levels from June through July 2025, indicating a rapid operational recovery.
After the takedown, Lumma operators reduced their heavy use of Cloudflare and diversified to other providers. Trend Micro observed Lumma domains using Russia-based provider Selectel, especially in June 2025 shortly after the disruption.
On the XSS underground forum, a primary Lumma developer said nearly 2,500 Lumma-related domains had been seized. The developer also alleged authorities exploited a suspected IDRAC vulnerability, formatted disks and backups twice, and replaced the control panel with a phishing page.
Trend Micro observed a slight decline in the number of unique accounts targeted by Lumma malware during May 2025 following the law enforcement action.
A global law enforcement operation in May 2025 seized or blocked about 2,300 malicious domains tied to Lumma Stealer, including five domains used as administrator and customer login panels. The action disrupted Lumma's command-and-control infrastructure and marketplaces and severed infected machines from Lumma servers.
Trend Micro published research describing threat actors using fake GitHub repositories with AI-generated README files to distribute LummaStealer and SmartLoader.
Trend Micro described Lumma Stealer as a prolific information-stealing malware-as-a-service operation active since late 2022.
After the takedown, the Lumma team claimed it regained access to its servers and disabled the vulnerable remote-management interface. Trend Micro said infrastructure activity began increasing again within weeks of the disruption.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
trendaisecurity.com
Open sourcejustice.gov
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Lumma Stealer** continued to expand as a prolific malware-as-a-service infostealer, with researchers reporting sharp growth in detections and increasingly diverse delivery chains. Microsoft attributed the malware and its command-and-control ecosystem to **Storm-2477**, which operates Lumma for affiliates that build payloads and run campaigns through a management panel. ESET reported Lumma detections surged **369%** in late 2024, while additional reporting from Netskope and other researchers highlighted ongoing **fake CAPTCHA/ClickFix** lures and fresh payload variants designed to evade detection. Observed campaigns used multiple infection paths, including phishing, malvertising, compromised websites, trojanized software, abuse of trusted platforms such as GitHub, and delivery by other malware including **DanaBot**. Microsoft described an early-April campaign that combined **EtherHiding** hosted through Binance Smart Chain smart contracts with ClickFix social engineering, and an April 7 campaign targeting Canadian organizations that used **Prometheus TDS** redirection plus `mshta` and PowerShell stages to deploy Lumma alongside **Xworm**. The malware was reported stealing credentials and cryptocurrency wallets, using process injection and hollowing, and relying on layered infrastructure with hardcoded domains and fallback channels through **Steam** and **Telegram** behind Cloudflare; Microsoft said its disruption effort led to the takedown, suspension, or blocking of about **2,300 malicious domains** tied to Lumma operations.
Aug 15, 2026
Security researchers reported sustained infostealer activity centered on **Lumma Stealer** and **Vidar**, with operators distributing malware through fake CAPTCHA lures, pirated software downloads, phishing emails, and poisoned search results. AhnLab said July 2026 campaigns commonly delivered **Remus, LummaC2, ACRStealer, and Vidar** via cracked software hosted on services including **mega.nz**, **Amazon S3**, and **MediaFire**, while Microsoft and other well-known brands were frequently impersonated. TrendAI separately described fake verification pages that trick victims into pasting malicious commands into the Windows Run dialog, leading to multistage infections that deployed **Lumma Stealer, Rhadamanthys, AsyncRAT, XWorm,** and **Emmenhtal**. The campaigns relied on evasive execution chains using `mshta.exe`, obfuscated PowerShell, DLL sideloading, temporary Chromium profiles, and even MP3 files carrying injected JavaScript to load payloads in memory and communicate with attacker-controlled infrastructure. Researchers also said **Vidar Stealer 2.0** expanded its appeal with a rewritten codebase, multithreaded theft, stronger anti-analysis, and broader credential and wallet theft, helping it gain momentum as some criminals moved away from Lumma after a doxxing incident and Telegram account compromise disrupted Lumma operations and eroded trust in its malware-as-a-service ecosystem. The reporting indicates that infostealer operators are rapidly shifting delivery methods and malware families while continuing to target both enterprises and individual users for credential theft and follow-on attacks.
Aug 21, 2026
Threat actors distributed **LummaStealer** through two social-engineering chains that targeted users seeking pirated software or attempting to pass fake verification prompts. One campaign, active since at least December 2024, used GitHub repositories, cracked-software forums, URL shorteners, and posts on platforms including Facebook, Devpost, TikTok, and Chromium issues to push victims toward malicious JavaScript. That script suppressed referrer leakage, captured page-title context, and redirected users through intermediary domains on `.cfd`, `.click`, `.info`, and `.xyz` before serving password-protected archives from **MEGA** that extracted a LummaStealer executable. A separate delivery chain used counterfeit **CAPTCHA** pages to trick users into opening the Windows Run dialog and pasting a PowerShell command that fetched follow-on instructions from a shortened URL, downloaded a ZIP archive from `vultrcdn[.]com`, and launched a disguised `Setup.exe`. The infection sequence relied on legitimate-looking or signed binaries such as a revoked `Mergecap.exe`, a renamed `BtDaemon.exe` as `StrCmp.exe`, `more.com`, and `searchindexer.exe`, indicating DLL sideloading and process injection for evasion. Investigators observed outbound traffic to suspicious domains including `accentypastedw[.]store` and `onefreex.com`, while analysis of the final payload showed infostealer behavior including scheduled task creation, cryptographic API use, timestamp tampering, and file-permission changes.
Jun 29, 2026