Back to Business: Lumma Stealer Returns with Stealthier Methods

The report documents a May 2025 law-enforcement operation that seized roughly 2,300 Lumma Stealer domains but shows the malware's quick, quiet resurgence; it details the operators' pivot in infrastructure (reduced Cloudflare use, more reliance on certain cloud/data center providers), multiple delivery vectors (fake cracks and keygens, ClickFix fake CAPTCHA executing fileless PowerShell/.NET loaders, GitHub repositories, and social media), continuing MaaS distribution, observed TTPs and hunting queries/IOCs, and concludes that Lumma remains a persistent, high-risk infostealer requiring ongoing detection, user training, and cross-sector collaboration.