Lumma Stealer Is Back & Stealthier Than Ever
ID: f427a370-3473-59a3-875e-89073762b6d4
STIX ID: report--f427a370-3473-59a3-875e-89073762b6d4
Feed Name: Dark Reading
Date Published: 2025-07-23
Date Updated: 2026-04-21
Author: Elizabeth Montalbano, Contributing Writer
Trend Micro reports a rapid resurgence of the Lumma stealer after an FBI disruption, with operators reestablishing infrastructure and resuming wide-ranging distribution campaigns (fake cracked software, keygens, ClickFix website overlays, GitHub-hosted lure repos, and social media). The operation shifted hosting away from heavy Cloudflare usage toward alternative providers including Russian data centers, demonstrating resilience and continued risk to credential and cryptocurrency theft across consumer and enterprise victims.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.