Monday, May 5, 2025
Homecyber securityLumma Stealer Attacking Users To Steal Login Credentials From Browsers

Lumma Stealer Attacking Users To Steal Login Credentials From Browsers

Published on

SIEM as a Service

Follow Us on Google News

Researchers observed Lumma Stealer activity across multiple online samples, including PowerShell scripts and a disguised EXE installer, as analysis revealed a parent-child relationship between these samples, all of which communicated with the same C2 server.

The Lumma Stealer Trojan, observed in the provided sample, employs advanced techniques to exfiltrate sensitive data from popular browsers and applications, which targets a wide range of information, including browser credentials, cryptocurrency wallet details, and user profiles from platforms like Steam and Discord, posing a significant threat to user privacy and security.

Sample execution process

The collection includes three files: a PowerShell script (“Trigger.ps1”), another PowerShell script (“BMB1tcTf.txt”) significantly larger in size, and an executable (“hhh.exe”), while SHA1 hashes are provided for each file for identification and integrity verification.

- Advertisement - Google News

Trigger.ps1 is a PowerShell script that downloads a file (BMB1tcTf.txt) and executes it if the environment is legitimate, which appears to be malicious as it attempts to download and execute another file (hhh.exe).

The malware sample, identified as GHOSTPULSE, gathers system information including operating system details, hardware specifications, loaded modules, and active processes after execution.

BMB1tcTf.txt code function

It creates a new process using more.com (an MS DOS command to display text content) and injects its payload using the Process Doppelgänging technique and then drops two files: one named more.com and another with a random lowercase letter combination filename.

Malware disguised as an AutoIt script (AutoIt3.exe) was delivered and contained a PNG image embedded with a malicious payload using the Ghostpulse technique, where the extracted payload indicates it can steal cryptocurrency and password-related data.

Connecting to the C2 host

According to Tianqiong sandbox analysts, Lumma Stealer is a Trojan that uses process injection (Heaven’s Gate technique) to execute 32-bit APIs in a 64-bit environment to steal system information, clipboards, browser passwords, etc. and send it to the C2 server.

It utilizes a multipart/form-data communication protocol with a unique boundary string to exfiltrate sensitive data, such as Firefox passwords, by establishing a session with a C2 server using a specific lifeID and transmitting stolen data in a compressed format, demonstrating advanced evasion techniques.

Aman Mishra
Aman Mishra
Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Latest articles

Claude AI Abused in Influence-as-a-Service Operations and Campaigns

Claude AI, developed by Anthropic, has been exploited by malicious actors in a range...

Threat Actors Attacking U.S. Citizens Via Social Engineering Attack

As Tax Day on April 15 approaches, a alarming cybersecurity threat has emerged targeting...

TerraStealer Strikes: Browser Credential & Sensitive‑Data Heists on the Rise

Insikt Group has uncovered two new malware families, TerraStealerV2 and TerraLogger, attributed to the...

MintsLoader Malware Uses Sandbox and Virtual Machine Evasion Techniques

MintsLoader, a malicious loader first observed in 2024, has emerged as a formidable tool...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Claude AI Abused in Influence-as-a-Service Operations and Campaigns

Claude AI, developed by Anthropic, has been exploited by malicious actors in a range...

Threat Actors Attacking U.S. Citizens Via Social Engineering Attack

As Tax Day on April 15 approaches, a alarming cybersecurity threat has emerged targeting...

TerraStealer Strikes: Browser Credential & Sensitive‑Data Heists on the Rise

Insikt Group has uncovered two new malware families, TerraStealerV2 and TerraLogger, attributed to the...