“The variations we saw in Lumma Stealer behavior are significant to defenders,” noted the Sophos Managed Detection and Response team in their report, emphasizing that these delivery techniques could easily be adapted for other malware beyond Lumma Stealer. Lumma Stealer, a notorious information-stealing malware active since mid-2022, has significantly evolved its tactics, techniques, and procedures in recent months. The malware employs sophisticated obfuscation techniques, including the use of initialization vectors and complex decryption routines, to evade traditional security measures. What makes Lumma particularly dangerous is its sophisticated delivery techniques, which have recently expanded to include social engineering through fake CAPTCHA challenges and deceptive download prompts. In this attack chain, victims visiting malicious sites are presented with a standard “I’m not a robot” verification prompt, creating a false sense of security and legitimacy. North Korean-linked advanced persistent threat (APT) group Kimsuky has deployed sophisticated new phishing tactics and malware payloads in targeted attacks observed in March 2025. Sophos researchers identified multiple Lumma Stealer campaigns during fall and winter 2024-25, documenting how the malware’s tactics have evolved to evade detection. The script retrieves additional malware components from command-and-control servers, ultimately downloading, extracting, and executing the core Lumma Stealer payload. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. These methods exploit user trust in familiar security verification processes, tricking victims into executing malicious commands on their own systems. Believed to originate from Russian-speaking cybercriminals, this malware continues to be distributed as a Malware-as-a-Service (MaaS) offering, with its developers providing regular updates and support via Telegram channels and a dedicated Gitbook site. The malware primarily targets valuable user data including passwords, session tokens, cryptocurrency wallets, and personal information from compromised devices. Security experts recommend implementing robust endpoint protection solutions with behavioral analysis capabilities, as signature-based detection alone proves inadequate against these evolving threats. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Once active, this malware systematically accesses browser data, as evidenced in Figure 6 where Autolt3.exe can be seen accessing login data and cookies from Chrome.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 12 May 2025 15:30:09 +0000