Lumma Stealer Chronicles: PDF-themed Campaign Using Compromised Educational Institutions' Infrastructure

### Executive Summary This report documents an active campaign distributing Lumma Stealer via malicious .lnk files hosted on WebDAV servers that invoke mshta.exe and PowerShell to retrieve an AES-encrypted payload (Kompass-4.1.2.exe). The analysis details obfuscated JavaScript and PowerShell stages, C2 infrastructure (including novel cloaking via Steam profile content), MITRE ATT&CK mappings, IoCs (file hashes, domains, IPs, URLs), and targeted industries, highlighting the need for user awareness and detection of the noted indicators and techniques.