Thursday, May 22, 2025
Homecyber securityLumma Stealer Attacking Users To Steal Login Credentials From Browsers

Lumma Stealer Attacking Users To Steal Login Credentials From Browsers

Published on

SIEM as a Service

Follow Us on Google News

Researchers observed Lumma Stealer activity across multiple online samples, including PowerShell scripts and a disguised EXE installer, as analysis revealed a parent-child relationship between these samples, all of which communicated with the same C2 server.

The Lumma Stealer Trojan, observed in the provided sample, employs advanced techniques to exfiltrate sensitive data from popular browsers and applications, which targets a wide range of information, including browser credentials, cryptocurrency wallet details, and user profiles from platforms like Steam and Discord, posing a significant threat to user privacy and security.

Sample execution process

The collection includes three files: a PowerShell script (“Trigger.ps1”), another PowerShell script (“BMB1tcTf.txt”) significantly larger in size, and an executable (“hhh.exe”), while SHA1 hashes are provided for each file for identification and integrity verification.

- Advertisement - Google News

Trigger.ps1 is a PowerShell script that downloads a file (BMB1tcTf.txt) and executes it if the environment is legitimate, which appears to be malicious as it attempts to download and execute another file (hhh.exe).

The malware sample, identified as GHOSTPULSE, gathers system information including operating system details, hardware specifications, loaded modules, and active processes after execution.

BMB1tcTf.txt code function

It creates a new process using more.com (an MS DOS command to display text content) and injects its payload using the Process Doppelgänging technique and then drops two files: one named more.com and another with a random lowercase letter combination filename.

Malware disguised as an AutoIt script (AutoIt3.exe) was delivered and contained a PNG image embedded with a malicious payload using the Ghostpulse technique, where the extracted payload indicates it can steal cryptocurrency and password-related data.

Connecting to the C2 host

According to Tianqiong sandbox analysts, Lumma Stealer is a Trojan that uses process injection (Heaven’s Gate technique) to execute 32-bit APIs in a 64-bit environment to steal system information, clipboards, browser passwords, etc. and send it to the C2 server.

It utilizes a multipart/form-data communication protocol with a unique boundary string to exfiltrate sensitive data, such as Firefox passwords, by establishing a session with a C2 server using a specific lifeID and transmitting stolen data in a compressed format, demonstrating advanced evasion techniques.

Aman Mishra
Aman Mishra
Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Latest articles

Versa Concerto 0-Day Flaw Enables Remote Code Execution by Bypassing Authentication

Security researchers have uncovered multiple critical vulnerabilities in Versa Concerto, a widely deployed network...

Hackers Targets Coinbase Users Targeted in Advanced Social Engineering Hack

Coinbase users have become the prime targets of an intricate social engineering campaign since...

Hackers Exploit PyBitmessage Library to Evade Antivirus and Network Security Detection

The AhnLab Security Intelligence Center (ASEC) has uncovered a new strain of backdoor malware...

Several GitLab Vulnerabilities Enable Attackers to Launch DoS Attacks

GitLab has issued critical security patches addressing 11 vulnerabilities across its Community Edition (CE)...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Versa Concerto 0-Day Flaw Enables Remote Code Execution by Bypassing Authentication

Security researchers have uncovered multiple critical vulnerabilities in Versa Concerto, a widely deployed network...

Hackers Targets Coinbase Users Targeted in Advanced Social Engineering Hack

Coinbase users have become the prime targets of an intricate social engineering campaign since...

Hackers Exploit PyBitmessage Library to Evade Antivirus and Network Security Detection

The AhnLab Security Intelligence Center (ASEC) has uncovered a new strain of backdoor malware...