Back to Business: Lumma Stealer Returns with Stealthier Methods

Lumma Stealer, an information-stealing malware, has resurfaced shortly after its takedown in May 2025. The cybercriminals behind it are now employing more covert tactics and expanding their reach. The malware is being distributed through discreet channels and uses stealthier evasion techniques. Lumma Stealer can steal sensitive data such as credentials and private files, and is marketed as a malware-as-a-service. Users are lured to download it through fake cracked software, deceptive websites, and social media posts. The malware's infrastructure has been diversified, with a shift towards using Russian-based cloud services. Recent campaigns include fake crack downloads, ClickFix campaigns using fake CAPTCHA pages, GitHub repository abuse, and social media promotions.

• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixMalware2026-09-29
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking MalwareMalware2026-10-21
• "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesCampaign2026-10-21
• PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP FlawsExploitedVulnerability2026-10-21
• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14