Lumma

Lumma is a sophisticated and stealthy malware, known for its extensive ability to harvest sensitive data from infected devices. It is primarily designed to steal passwords, card details, cryptocurrency wallets, and browser session cookies. The malware has evolved with new anti-sandbox methods, making it harder to detect and enabling it to inject itself into legitimate Windows processes to evade basic antivirus software. Lumma is often delivered to victims through deceptive downloads, such as a disguised trial download that instead serves a .zip file containing the malicious payload. The exploitation of the Microsoft Defender SmartScreen bug CVE-2024-21412 has been a significant delivery mechanism for Lumma, among other malware like ACR and Meduza Stealers. Once users agree to a personal use disclaimer and initiate a download, they are served with a .zip file containing the malicious payload leading to the Lumma Stealer. This malware uses a DLL side-loading technique for execution, further enhancing its stealth. In some instances, Lumma was sent over Latrodectus C2, a command-and-control server used by cybercriminals. Lumma's stealthy approach and advanced capabilities have made it one of the most common infostealers in the world today. It ranked as the sixth most prevalent malware in the wild, according to a report by Red Canary. Despite appearing as a legitimate tool or harmless download, Lumma can deliver further malware such as ransomware, posing serious security threats. Bitdefender warns of Lumma's danger, particularly due to its ability to remain undetected while harvesting data from infected devices.