Hacker trap: Fake OnlyFans tool backstabs cybercriminals, steals passwords

Veriti Research uncovered a deception campaign where a fake OnlyFans "checker" distributed the Lumma stealer via a GitHub-hosted payload; once executed the malware exfiltrates credentials, two-factor tokens, browser cookies, and cryptocurrency wallets and connects to .shop C2 domains. The GitHub account 'UserBesty' hosts additional fake tools (DisneyChecker.exe, InstaCheck.exe, ccMirai.exe) used to lure other cybercriminals, demonstrating active malware distribution and C2 infrastructure tied to the campaign.