Behind the Curtain: How Lumma Affiliates Operate

This report analyzes the Lumma infostealer MaaS and its affiliates, revealing a large, resilient, and interconnected information-stealing ecosystem that leverages proxies, VPNs, anti-detect browsers, crypting/exploit services, SMS/phone services, and underground forums to distribute malware, monetize stolen data, and run parallel scams (including rental fraud). Insikt Group documents previously unreported tooling (e.g., cracked email validators, phishing page generators), the use of additional stealers (Vidar, Stealc, Meduza), hosting and AV-testing services, and provides IoCs and ATT&CK mappings to help defenders detect and mitigate infections.