LummaStealer activity spikes post-law enforcement disruption

Bitdefender observed a sharp rebound in LummaStealer (a Malware-as-a-Service infostealer) activity after 2025 takedowns, driven by evolving social-engineering lures (fake CAPTCHAs, bogus Steam updates) and the rising use of CastleLoader as an in-memory loader; the report documents distribution chains, loader behaviors, infrastructure overlap, global infection prevalence (noted infections in the hundreds of thousands), ties to ransomware groups, and recommended mitigations such as avoiding untrusted downloads and enabling MFA.