Security analysts at Cloudsek noted that the malware employs advanced evasion techniques like obfuscated scripts and encrypted communications with Command-and-Control (C2) servers. This sophisticated campaign exploits malicious LNK (shortcut) files disguised as legitimate PDFs, initiating multi-stage infection processes that compromise sensitive data. It is designed to exfiltrate a wide range of data, including browser credentials, cryptocurrency wallets, and sensitive files such as academic research or financial records. Once decrypted, the PowerShell script downloads and executes the Lumma Stealer binary from remote servers. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The Lumma InfoStealer malware has been observed leveraging weaponized PDF documents to target educational institutions. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Organizations must implement proactive defenses like endpoint detection systems and user awareness programs to mitigate risks posed by deceptive phishing tactics and weaponized documents. These files, upon execution, trigger a PowerShell command that connects to a remote server, launching the infection chain. To evade detection, Lumma Stealer encrypts exfiltrated data and employs event-controlled write operations. The malware then scans the compromised system for files containing keywords like wallet.txt or passwords.pdf, targeting sensitive information. This command downloads and executes additional payloads, including the Lumma Stealer executable. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. The attack begins with unsuspecting users downloading LNK files masquerading as academic or technical documents. Educational infrastructures, often less fortified against advanced cyberattacks, have become prime targets for this information-stealing malware. The PowerShell script is obfuscated and encrypted using AES in CBC mode, ensuring stealth during execution.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 18 Feb 2025 15:55:12 +0000