Beware! YouTube Videos Promoting Cracked Software Distribute Lumma Stealer

Fortinet FortiGuard Labs warns of an active campaign where threat actors publish YouTube videos promoting cracked software that link to bogus installers (hosted on services like MediaFire). The installers unpack a ZIP containing a malicious Windows LNK that downloads a .NET loader from GitHub, performs anti-VM/anti-debug checks, and then loads the Lumma stealer — which harvests and exfiltrates sensitive data; the report notes similar past campaigns (RedLine, Vidar, AsyncRAT) and warns of credential/session cookie theft and illicit crypto-mining.