MalwarePublished 3 Aug 2025Updated 2 Sep 2025

FAKE TELEGRAM PREMIUM SITE DISTRIBUTES NEW LUMMA STEALER VARIANT

Source AlienVault OTX General

Description

A malicious campaign using the domain 'telegrampremium[.]app' is distributing a new variant of Lumma Stealer malware. The fake site mimics the official Telegram Premium platform and automatically downloads an executable file 'start.exe' upon access. This sophisticated information-stealing trojan can exfiltrate browser credentials, cryptocurrency wallet details, and system information. The malware employs various techniques for persistence, defense evasion, and data theft, including file system manipulation, registry modification, and clipboard operations. The campaign highlights the ongoing use of brand impersonation and social engineering for large-scale malware distribution, emphasizing the need for robust security measures and user awareness.

Impact

For European organizations, this threat poses a medium to high risk primarily due to the potential compromise of user credentials and sensitive financial information, including cryptocurrency wallets. Credential theft can lead to unauthorized access to corporate accounts, email systems, and internal resources, potentially resulting in data breaches, financial fraud, or lateral movement within networks. The malware’s ability to persist and evade detection increases the likelihood of prolonged compromise, which can exacerbate damage. Organizations with employees or customers who use Telegram Premium or related services are particularly vulnerable to social engineering attacks leveraging this fake site. The theft of browser credentials may also expose access to other corporate web services, increasing the attack surface. Additionally, the exfiltration of system information could aid attackers in tailoring further attacks or exploiting other vulnerabilities. The campaign’s use of drive-by downloads means that even a single visit to the malicious site can result in infection, increasing the risk of widespread impact if the domain is accessed from corporate networks. Given the increasing adoption of cryptocurrencies in Europe, theft of wallet credentials could lead to direct financial losses. Overall, this threat could disrupt business operations, compromise sensitive data, and cause reputational damage to affected organizations.

Defensive guidance

1. Implement robust web filtering solutions to block access to known malicious domains such as 'telegrampremium.app' and the associated suspicious domains listed in the indicators. 2. Deploy endpoint detection and response (EDR) tools capable of identifying and blocking information-stealing malware behaviors, including file system manipulation, registry changes, and clipboard monitoring. 3. Enforce strict application whitelisting policies to prevent unauthorized execution of unknown executables like 'start.exe'. 4. Conduct targeted user awareness training focusing on the risks of brand impersonation, phishing, and drive-by downloads, emphasizing verification of URLs and the dangers of downloading executables from untrusted sources. 5. Regularly audit and monitor browser credential stores and cryptocurrency wallet applications for unauthorized access or anomalies. 6. Utilize multi-factor authentication (MFA) across all critical systems to mitigate the impact of credential theft. 7. Maintain up-to-date threat intelligence feeds and integrate them with security controls to promptly block emerging indicators of compromise. 8. Monitor network traffic for unusual outbound connections, especially to the IP address 87.120.126.213 and the domains listed, to detect potential data exfiltration attempts. 9. Implement strict privilege management to limit the ability of malware to modify registry keys or system files. 10. Encourage the use of hardware wallets or secure wallet management practices to reduce the risk of cryptocurrency theft.

Indicators of compromise

Domains 9

annwt.xyz
cidtfhh.shop
daruubs.top
furwmsx.shop
greqjfu.xyz
prvqhm.shop
rayrhs.top
teijx.lat
ungryo.shop

IP addresses 1

87.120.126.213

Hashes 11

86170725074de3b8edcd7671afa9b69d
0736ccd4920e227ebae3b0ded4950c01f663af6a
1f6ed1d5980390406d7d9e7aea1c18901468ef6c
3921ba3ad9ace63827a8ad2d70c1c4a79d462f24
7a77f579c6a4bda83d659be4e39ddfd7b7e2f73c
888e33a919d5dda152a539aed3f5a3b7840937bc
8c893331a5e01e0c99a7ad0f7f1cbb9418a86d4a
9a5f72502fd9be56226716e6435888a43ff43154
fc0e3ff066427316bcb001d05b3ac5692093d6a3
b97dcfb5161a59bd88fd821542e9d066c77c4ad49f09c81f472b26a5339f44f2

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Aug 2025, 09:17 UTC

MITRE ATT&CK techniques21 from threat tags

Technical details

Indicators of compromise

Domains 9

IP addresses 1

Hashes 11

Community reviews

Related threats