Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Lumma Stealer, an information-stealing malware, has resurfaced shortly after its takedown in May 2025. The cybercriminals behind it are now employing more covert tactics and expanding their reach. The malware is being distributed through discreet channels and uses stealthier evasion techniques. Lumma Stealer can steal sensitive data such as credentials and private files, and is marketed as a malware-as-a-service. Users are lured to download it through fake cracked software, deceptive websites, and social media posts. The malware's infrastructure has been diversified, with a shift towards using Russian-based cloud services. Recent campaigns include fake crack downloads, ClickFix campaigns using fake CAPTCHA pages, GitHub repository abuse, and social media promotions.

Lumma Stealer is a type of information-stealing malware that has re-emerged shortly after its takedown in May 2025. This malware is designed to covertly harvest sensitive information such as user credentials, private files, and other valuable data from infected systems. The operators behind Lumma Stealer have enhanced its stealth capabilities and diversified its distribution and infrastructure methods to avoid detection and takedown efforts. The malware is distributed primarily through social engineering tactics, including fake cracked software downloads, deceptive websites, social media promotions, and campaigns exploiting fake CAPTCHA pages (ClickFix campaigns). Additionally, the threat actors abuse legitimate platforms such as GitHub repositories to host malicious payloads or facilitate distribution, complicating detection and mitigation efforts. The infrastructure supporting Lumma Stealer has shifted towards Russian-based cloud services, which may provide resilience against takedown attempts and complicate attribution. The malware is marketed as malware-as-a-service (MaaS), allowing a broad range of cybercriminals to deploy it without needing advanced technical skills. The use of multiple evasion techniques, including obfuscation, encrypted communications, and diversified command-and-control (C2) channels, enables the malware to remain undetected for longer periods. The threat actor group associated with Lumma Stealer is identified as Water Kurita. The malware leverages various MITRE ATT&CK techniques such as credential access (T1056.001), command and scripting interpreter (T1059.001), user execution (T1204), and data exfiltration (T1041), among others, highlighting its sophisticated operational capabilities. Although no specific affected software versions are listed, the infection vector primarily targets end users through social engineering and software piracy channels.

Detailed information about Back to Business: Lumma Stealer Returns with Stealthier Methods. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'github abuse'

Filter Threats

Threats Tagged 'github abuse'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility