Once-hobbled Lumma Stealer is back with lures that are hard to resist

After a significant crackdown by global law enforcement last May, Lumma Stealer, a notorious infostealer, has returned with alarming vigor. This malicious software, which affected nearly 395,000 Windows computers in just two months prior to the operation, is now executing sophisticated attacks that are difficult to detect, targeting sensitive information and user credentials. Initially surfacing in Russian-speaking cybercrime forums in 2022, Lumma operates under a cloud-based malware-as-a-service model. This approach has enabled it to maintain a vast network of domains for hosting enticing lure sites that offer free cracked software, pirated games, and movies. This expansive infrastructure has made it a favorite among cybercriminals, with premium versions reportedly priced as high as $2,500. By the spring of 2024, the FBI had identified over 21,000 listings related to Lumma on various crime forums. Last year, Microsoft noted that Lumma had become an essential tool for several crime syndicates, including the notorious Scattered Spider group. In response, the FBI, alongside an international coalition, initiated a significant operation that led to the seizure of 2,300 domains and critical command-and-control infrastructure, aiming to dismantle the criminal networks supporting Lumma. Despite these efforts, researchers from Bitdefender have revealed that Lumma Stealer is back in action, having rapidly reconstructed its infrastructure and spreading its malware globally. The resurgence of Lumma is largely attributed to a deceptive social engineering tactic known as "ClickFix." This method employs fake CAPTCHAs that trick users into executing malicious commands by copying and pasting text into a Windows terminal, effectively allowing the malware to install itself on victims' machines. The return of Lumma highlights the ongoing battle between cybersecurity efforts and evolving cyber threats, underscoring the need for continued vigilance among users and security professionals alike.