Threats Tagged 'lumma'

A widespread phishing campaign is distributing AsyncRAT and Remcos remote access trojans (RATs) via malicious Excel spreadsheets. The emails impersonate legitimate business communications such as purchase orders and payment advice. Enabling macros triggers VBA code that downloads HTA payloads using URL shorteners and Cloudflare Workers. The infection chain is multi-stage and heavily obfuscated, employing Base64 encoding, steganography in PNG files, and character substitution. The campaign intensified in June 2026 and targets organizations globally across multiple industries.

Since late 2025, cybercriminals have been exploiting Wallpaper Engine, a popular live wallpaper application on Steam, to distribute malware through Steam Workshop. Attackers target primarily Chinese and Russian gamers by embedding malicious code within application wallpapers shared on the platform. These compromised wallpapers deliver various malware types including infostealers, backdoors, crypto miners, and ransomware. One analyzed sample dropped DarkKomet backdoor while hijacking Steam sessions to steal account credentials. The malware modifies system libraries to locate Steam installations and exfiltrate data to attacker-controlled servers. Compromised accounts are then used to upload additional malicious wallpapers. The diverse malware families suggest multiple independent hacking groups are exploiting this distribution method. Infected wallpapers received thousands of downloads before removal, with 89% of infections occurring in China.

MediumMalwareBritish Indian Ocean TerritoryCanadaChina+5#account hijacking#vidar#wallpaper engine