Beware of fake CrowdStrike domains pumping out Lumma infostealing malware

CrowdStrike has been impersonated in a phishing campaign that lures Windows users to download a purported recovery tool from a malicious domain (crowdstrike-office365.com). The archive contains a malicious MSI that drops a multi-stage loader (self-extracting RAR -> NSIS/AutoIt) which executes shellcode and deploys the Lumma infostealer; the campaign uses social-engineering (email + follow-up phone calls), targets corporate networks, and shares infrastructure with earlier Lumma distributions.