Threats Tagged 'browser fingerprinting'

Lumma Stealer malware has resurged since October 2025, now incorporating adaptive browser fingerprinting to enhance its command-and-control (C&C) operations. It collects detailed system, network, hardware, and browser information via JavaScript payloads and stealthy HTTP communications, enabling it to assess victim environments and evade detection. The malware continues to use process injection and maintains its core C&C communication structure while adding these new evasion and targeting capabilities. This hybrid approach improves operational continuity, targeting precision, and detection avoidance. Although no known exploits are currently reported in the wild, the malware’s stealth and data exfiltration capabilities pose a medium-level threat. European organizations should be aware of this evolving infostealer, especially those with high-value data and browser-based workflows. Mitigation requires advanced endpoint detection, network monitoring for stealthy HTTP traffic, and browser security hardening. Countries with significant digital economies and high adoption of targeted software are at greater risk.

MediumMalwareGermanyFranceNetherlands+4#evasion techniques#browser fingerprinting#lumma stealer

Threat actors are exploiting the popularity of AI tools by using Black Hat SEO techniques to poison search engine rankings for AI-related keywords. These malicious websites redirect users through multiple layers to deliver malware such as Vidar, Lumma, and Legion Loader. The attackers employ sophisticated JavaScript to collect browser data, perform fingerprinting, and evade detection. The malware payloads are often packaged in large installer files to bypass sandboxes. The campaign uses trusted platforms like WordPress and AWS CloudFront to appear legitimate. Victims are lured through high-ranking search results for AI topics, leading to infection chains involving stealer malware and cryptocurrency-stealing browser extensions.

MediumMalwareUnited KingdomGermanyFrance+3#vidar#search engine poisoning#legion loader