Threats Tagged 'lummac2'

This analysis covers infostealer distribution trends during August 2026, focusing on distribution channels, detection rates, and disguise techniques. Primary infostealers identified include Remus, Vidar, LummaC2, and ACRStealer, distributed through crack software disguises, SEO poisoning, and file-hosting platforms like Mega and Mediafire. Malware disguised itself as legitimate companies, with Microsoft Corporation being the most frequently impersonated. Distribution methods included DLL side-loading using python37.dll and python36.dll, and exploitation of Renpy game development tool. Email campaigns delivered Formbook disguised as Turkish bank statements and AgentTesla as business quote requests from Indian companies. EXE files constituted 97.3% of execution types. The stolen information poses risks for dark web trading and secondary attacks, emphasizing the need for cautious handling of untrusted links, avoiding illegal software, enabling two-factor authentication, and maintaining updated security soluti...

MediumMalwareBritish Indian Ocean TerritoryIndia#email distribution#lummac2#infostealer

MacSync Stealer is a macOS information stealer and remote-access stager delivered through ClickFix social engineering and malvertising campaigns. Operating under a malware-as-a-service model, it employs sophisticated evasion techniques including process daemonization, single-byte XOR obfuscation, and in-memory AppleScript execution to bypass Apple Gatekeeper, XProtect, and EDR solutions. The malware exfiltrates credentials, browser data, cryptocurrency wallets, and SSH keys through fault-tolerant 10MB chunked uploads to command-and-control infrastructure. MacSync targets professionals in software engineering, cryptocurrency, fintech, and corporate environments across North America, Europe, and Asia-Pacific regions, with campaigns impersonating legitimate services like Google Meet, Claude AI, Docker, and TradingView to trick victims into executing malicious Terminal commands.

MediumMalwareUnited StatesAustraliaBritish Indian Ocean Territory+7#credential theft#obfuscation#applescript

During June 2026, multiple infostealer families including Remus, ACRStealer, LummaC2, and Vidar were distributed through SEO poisoning techniques, disguised as illegal software such as cracks and keygens. Attacks utilized EXE files (84.5%) and DLL side-loading (15.5%) methods, with distribution primarily through Mediafire, Mega, and cloud storage platforms. Microsoft Corporation was the most frequently impersonated entity. MacOS environments were targeted through ClickFix techniques and malicious Bash scripts, with one variant dynamically obtaining C2 addresses via Polygon smart contracts. Email-based campaigns distributed AgentTesla and DarkCloud through compressed attachments, with both variants exfiltrating data via SMTP. The stolen credentials pose significant risks for dark web trading and secondary attacks.

This analysis covers infostealer distribution trends observed during May 2026, based on automated collection systems and diagnostic logs. Distribution occurred primarily through illegal software disguised as cracks and keygens, as well as email campaigns. ACRStealer, Remus, and LummaC2 were most prevalent, with distribution via domains including Mediafire and AWS S3 buckets. Microsoft was the most impersonated company, followed by Auslogics and NVIDIA. EXE files represented 78.9% of execution types, while DLL side-loading accounted for 21.1%. macOS environments saw ClickFix techniques and malicious Bash scripts, with 142 scripts and 12 C2 domains identified. Email campaigns distributed AgentTesla and DarkCloud. Remus showed significant growth, comprising 36% of distributions. LummaC2 remained the most prevalent overall variant.

This analysis examines Infostealer malware trends during December 2025, focusing on distribution methods, volume, and disguising techniques. Key findings include the prevalence of ACRStealer, LummaC2, and Stealc Infostealers, with malware primarily distributed through SEO poisoning and compromised legitimate websites. The report highlights two significant trends: the abuse of Python scripts for malware distribution and the emergence of cryptocurrency-stealing malware using Tor. Distribution methods evolved from direct blog posts to leveraging legitimate websites and forums. The analysis also notes a shift in malware execution methods, with 65.8% distributed as EXE files and 34.2% using DLL Sideloading techniques. The report emphasizes the importance of vigilance against these evolving threats and provides detailed insights into the malware's behavior and infrastructure.

MediumMalwareGermanyFranceUnited Kingdom+4#python abuse#pyagent#stealc

A multi-stage malware execution chain originating from a ClickFix lure has been discovered, leading to the delivery of infostealing malware like LummaC2 and Rhadamanthys. The campaign utilizes steganography to hide malicious code within PNG images. Two distinct ClickFix lures were observed: a standard 'Human Verification' and a convincing fake Windows Update screen. The execution chain involves mshta.exe, PowerShell, and .NET assemblies, ultimately extracting and injecting shellcode into target processes. The steganographic technique encodes malicious data directly into image pixel data, using specific color channels for payload reconstruction and decryption in memory. This sophisticated approach helps evade signature-based detection and complicates analysis.

MediumMalwareGermanyFranceUnited Kingdom+5#multi-stage#social engineering#steganography

The October 2025 Infostealer Trend Report highlights the ongoing and evolving threat posed by Infostealer malware families such as Rhadamanthys, ACRStealer, and LummaC2. Attackers have shifted distribution tactics, increasingly leveraging legitimate websites to evade detection and search engine restrictions, a technique known as SEO poisoning. A notable development is the mass distribution of a new Loader malware employing DLL sideloading to execute malicious payloads stealthily. The report also details changes in LummaC2 distribution patterns and the use of sophisticated disguise and phishing techniques to target companies. These Infostealers aim to exfiltrate sensitive information, posing risks to confidentiality and potentially enabling further attacks. The threat does not require known exploits or zero-day vulnerabilities but relies on social engineering and advanced evasion methods. European organizations are at risk due to the widespread use of affected malware and the targeting of companies via phishing. Mitigation requires proactive detection of DLL sideloading, monitoring for SEO poisoning campaigns, and enhanced phishing defenses.

MediumCampaignGermanyFranceNetherlands+3#seo poisoning#rhadamanthys#acrstealer

Olymp Loader is a recently emerged Malware-as-a-Service offering advertised on underground forums since June 2025. Developed by a team called OLYMPO, it's written in assembly language and marketed as fully undetectable. The loader executes other malware on victim systems and provides built-in stealer modules for browsers, Telegram, and crypto wallets. It enables rapid feature updates and fast adoption by cybercriminals. The malware has evolved from an initial botnet concept to focus on loader and crypter functionalities. Distribution methods include disguising as legitimate software and using other malware like Amadey as initial access. Post-infection payloads primarily include credential stealers and remote access tools.

MediumMalwareGermanyFranceUnited Kingdom+5#qasarrat#stealer#malware-as-a-service

This analysis examines Infostealer trends in August 2025, focusing on distribution volume, methods, and disguises. AhnLab's automated systems collect and analyze malware, providing real-time IOC services. Infostealers, often disguised as cracks, are distributed through SEO poisoning. Notable variants include LummaC2, ACRStealer, and Rhadamanthys. Distribution methods evolved from personal blogs to legitimate websites, bypassing search engine restrictions. Malware is primarily distributed as EXE files (89.7%) or through DLL-SideLoading (10.3%). Two significant trends emerged: mass distribution via Slack Marketplace and ACRStealer's domain masquerading technique, which now targets security company domains to evade detection.

MediumMalwareGermanyUnited KingdomFrance+3#rhadamanthys#slack#infostealer

This analysis provides insights into Infostealer malware trends observed in June 2025. The data, collected through various automated systems, reveals changes in distribution methods and malware types. While LummaC2 has been dominant, June saw increased activity from Rhadamanthys, ACRStealer, Vidar, and StealC. A new variant of ACRStealer emerged, using advanced techniques like HTTP host domain spoofing and anti-analysis methods. Distribution via crack disguises decreased, with 94.4% in EXE format and 5.6% using DLL-SideLoading. A unique malware type was observed, creating an uncontrollable window prompting browser updates. Some samples now hide compression passwords in image files, indicating evolving evasion tactics.

MediumCampaignGermanyFranceUnited Kingdom+7#acrstealer#infostealer#lummac2