Lumma

Lumma is a malicious software (malware) that has been causing significant security concerns due to its ability to steal sensitive information. The malware was delivered to victims primarily through websites hosting cracked games, specifically targeting gamers. In August and September, researchers reported campaigns where Lumma was deployed using a deceptive CAPTCHA system. Furthermore, the malware was found to be part of a larger cyber threat landscape involving other malware families such as Vidar, Aresloader, and Canyon, among others. Interestingly, Lumma was also found to be associated with other notorious malware like RedLine, Meta, Vidar, and Raccoon Stealer that had infected devices storing Snowflake access credentials as early as 2020. The delivery of Lumma was facilitated by an exploit in Microsoft Defender SmartScreen, identified as CVE-2024-21412. This vulnerability allowed hackers to deliver not only Lumma but also other malware such as ACR and Meduza Stealers. Over time, Lumma evolved to survive disruptive operations by law enforcement, adapting and adopting new techniques to ensure its persistence. For instance, it was observed being sent over Latrodectus C2, and even being delivered alongside the Amadey Trojan. By July, more than 250 million estimated players were targeted and lured into downloading Lumma Stealer through multiple simultaneous scams. Given the rapid evolution of threats like Lumma Stealer, continuous monitoring, adaptation, and regular updating of detection rules, indicators of compromise, and security controls are necessary, says Sarah Jones, a cyber-threat intelligence research analyst at Critical Start. Lumma's tactics range from leveraging legitimate software to utilizing deceptive delivery methods, making it a persistent challenge for security teams. Protection against ongoing Lumma Stealer threats requires close collaboration between threat intelligence, security operations centers (SOCs), and incident-response teams. As Kumar notes, the investigation into Lumma Stealer reveals an evolving threat landscape characterized by the malware’s ability to adapt and evade detection.