Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A malicious campaign using the domain 'telegrampremium[.]app' is distributing a new variant of Lumma Stealer malware. The fake site mimics the official Telegram Premium platform and automatically downloads an executable file 'start.exe' upon access. This sophisticated information-stealing trojan can exfiltrate browser credentials, cryptocurrency wallet details, and system information. The malware employs various techniques for persistence, defense evasion, and data theft, including file system manipulation, registry modification, and clipboard operations. The campaign highlights the ongoing use of brand impersonation and social engineering for large-scale malware distribution, emphasizing the need for robust security measures and user awareness.

This threat involves a malicious campaign leveraging a fake website impersonating the official Telegram Premium platform, hosted at the domain 'telegrampremium.app'. Upon visiting the site, users are subjected to a drive-by download of an executable file named 'start.exe', which is a new variant of the Lumma Stealer malware. Lumma Stealer is an information-stealing trojan designed primarily for Windows systems. This malware is capable of exfiltrating sensitive data such as browser credentials, cryptocurrency wallet information, and detailed system information. The malware employs multiple advanced techniques to maintain persistence on infected systems, evade detection, and facilitate data theft. These techniques include manipulation of the file system, modification of Windows registry keys, clipboard data interception, and potentially process injection or obfuscation methods as indicated by the MITRE ATT&CK tags (e.g., T1055 - Process Injection, T1027 - Obfuscated Files or Information). The campaign exploits brand impersonation and social engineering tactics to lure victims into downloading the malware, highlighting the ongoing threat posed by fake websites mimicking trusted brands. Indicators of compromise include multiple file hashes, suspicious domains, and an IP address linked to the campaign. Although no known exploits in the wild are reported, the malware’s capability to steal credentials and cryptocurrency wallets poses a significant risk to affected users and organizations. The campaign underscores the importance of vigilance against phishing and drive-by download attacks, especially those exploiting popular platforms like Telegram.

Detailed information about FAKE TELEGRAM PREMIUM SITE DISTRIBUTES NEW LUMMA STEALER VARIANT. Get real-time updates, technical details, and mitigation strategies

Title	Severity	Type	Source	Date

Threats Tagged 'telegram premium'

Filter Threats

Threats Tagged 'telegram premium'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility