Tag: lummastealer

10 Attack Reports | 0 Vulnerabilities

Attack reports

GhostSocks: From Initial Access to Residential Proxy

GhostSocks is a Malware-as-a-Service (MAAS) that converts compromised devices into residential proxies, enabling threat actors to bypass anti-fraud mechanisms. Introduced in October 2023, it gained popularity after partnering with LummaStealer in February 2024. The malware, coded in Golang, uses ob…

residential proxy

double victimization

Published: October 1, 2025

Downloadable IOCs: 12

650 Attack Tools, One Coordinated Campaign

The GreedyBear attack group has launched a massive crypto theft operation, utilizing 150 weaponized Firefox extensions, nearly 500 malicious executables, and numerous phishing websites. Their tactics include Extension Hollowing to bypass marketplace security, distributing various malware families, …

browser extensions

extension hollowing

Published: August 8, 2025

Downloadable IOCs: 111

Fake Cloudflare Verification Results in LummaStealer Trojan Infections

A malicious campaign targeting Windows users through WordPress websites is deploying the LummaStealer trojan. Attackers use fake Cloudflare verification prompts to trick users into running malicious PowerShell commands. The infection is spread through compromised plugins or injected JavaScript in l…

javascript injection

Published: March 20, 2025

Downloadable IOCs: 4

Booking a Threat: Inside LummaStealer's Fake reCAPTCHA

A new malicious campaign targeting booking websites has been discovered, utilizing LummaStealer, an info-stealer operating under a Malware-as-a-Service model. The attack employs fake CAPTCHAs to trick users into executing malicious PowerShell commands. Initially targeting the Philippines, the campa…

social engineering

booking websites

indirect control flow

Published: March 4, 2025

Downloadable IOCs: 12

DNS Early Detection - Fast Propagating Fake Captcha distributes LummaStealer

Between October 2024 and February 2025, LummaStealer malware was distributed via fake CAPTCHA pages, targeting users who store sensitive information in browsers and cryptocurrency wallets. The malware, available as a Malware-as-a-Service, collects data for fraud and unauthorized access. Threat acto…

malware-as-a-service

information stealer

early detection

malicious domains

dns traffic analysis

Published: February 28, 2025

Downloadable IOCs: 11

Chinese Malware Delivery Websites

A cluster of over 400 domains have been registered since June 2024 to host spoofed websites delivering malware to Chinese-speaking users. The sites imitate popular applications like web browsers, VPNs, messaging apps, and crypto wallets. Identified malware includes Gh0stRAT, ValleyRAT, RemKos RAT, …

credential theft

malware delivery

remote access trojans

chinese-speaking users

spoofed websites

Published: January 16, 2025

Downloadable IOCs: 526

How Cracks and Installers Bring Malware to Your Device

Trend Micro research shows how attackers use platforms like YouTube to spread fake installers via trusted hosting services, employing encryption to evade detection and steal sensitive browser data.

malware detection

Published: January 14, 2025

Downloadable IOCs: 0

Your Data Is Under New Management: The Rise of LummaStealer

LummaStealer, a relatively new information-stealing malware, has gained prominence since 2022 for its ability to collect sensitive data from Windows systems. Marketed as Malware-as-a-Service (MaaS) on underground forums, it targets individuals, cryptocurrency users, and small to medium-sized busine…

social engineering

malware-as-a-service (maas)

Published: December 18, 2024

Downloadable IOCs: 0

Crypted Hearts: Exposing the HeartCrypt Packer-as-a-Service Operation

This analysis examines HeartCrypt, a new packer-as-a-service (PaaS) used to protect malware. Developed since July 2023 and launched in February 2024, HeartCrypt charges $20 per file to pack Windows x86 and .NET payloads. It is primarily used by malware operators of families like LummaStealer, Remco…

redline stealer

process hollowing

packer-as-a-service

Published: December 14, 2024

Downloadable IOCs: 0

CVE-2024-38213: From Crumbs to Full Compromise in a Stealthy Cyber Attack

A targeted email campaign exploiting CVE-2024-38213 has been uncovered, disguised as communication related to the Gas Infrastructure Europe Annual Conference in Munich. The attack bypasses standard security protocols to deploy LummaStealer malware, stealing sensitive data. The vulnerability, known …

Published: November 8, 2024

Downloadable IOCs: 0

Click here to see more Attack Reports