Beware Weaponized YouTube Channels Spreading Lumma Stealer

Researchers observed a campaign spreading a Lumma Stealer variant through YouTube channels that host cracked-software tutorials; links in video descriptions point to ZIP files on file-sharing services that contain LNK files which trigger PowerShell to fetch an obfuscated .NET loader from GitHub, ultimately deploying Lumma to harvest credentials, browser data, and system information. The loader employs environment checks (anti-debugging, sandbox/VM detection) and payload injection techniques, and the latest variant uses HTTPS for exfiltration; Fortinet published IoCs and recommended cautious sourcing and security awareness training.