Lumma Password Stealer: 394,000 Windows PCs Infected - Microsoft

Lumma Info-Stealer Malware Operation Disrupted

A significant disruption of the Lumma malware operation has been announced jointly by Microsoft and law enforcement agencies.

This action, authorized by a court, targeted a widespread info-stealer impacting over 394,000 Windows PCs worldwide.

Geographic Distribution of Infections

The majority of infected systems were located in Brazil, Europe, and the United States.

Domain Seizure

Microsoft initiated civil proceedings to secure a court order for the seizure of 2,300 domains.

These domains functioned as the command and control network for the Lumma malware.

Furthermore, the Justice Department independently seized an additional five domains utilized in the operation of the Lumma infrastructure.

How Lumma Infects Systems

The Lumma password stealer is commonly distributed through compromised software.

Specifically, it is often found within illicit games or cracked applications obtained from online sources.

Data Theft and Secondary Infections

Upon successful infection, the malware proceeds to steal sensitive information from the compromised computer.

This stolen data includes login credentials, passwords, credit card details, and cryptocurrency wallet information.

The harvested data is then sold to other malicious actors within the cybercriminal ecosystem.

Beyond data theft, Lumma also establishes a backdoor, enabling hackers to deploy further malware, such as ransomware.

Connection to Larger Cyberattacks

Password-stealing malware, including Lumma, has been implicated in large-scale cyberattacks targeting prominent tech companies.

Notable examples include breaches affecting PowerSchool and Snowflake, resulting in substantial data exfiltration.

These incidents highlight the significant threat posed by info-stealers to organizations and individuals alike.