Attackers Spread Lumma Stealer Malware GitHub Comments

Cybercriminals are leveraging platforms like GitHub to spread the Lumma information stealer malware.

This sophisticated threat is part of a growing trend where attackers use legitimate services to distribute malicious tools, posing significant risks to users worldwide.

What is Lumma Stealer?

Lumma Stealer is a highly advanced malware designed to siphon sensitive information from unsuspecting victims.

It targets stored browser passwords, cookies, cryptocurrency data, and information from email clients.

Known for its cutting-edge credential theft techniques, Lumma Stealer is often among the first to exploit new vulnerabilities, such as session cookie recovery for Google accounts.

Distributed through a Malware-as-a-Service (MaaS) model, Lumma Stealer is accessible to cybercriminals via subscription, making it a prevalent threat on platforms like Telegram and underground forums.

What Does MITRE ATT&CK Expose About Your Enterprise Security? - Watch Free Webinar!

A Growing and Fast-Spreading Threat

According to the GenDigital reports, The creators of Lumma Stealer have devised an efficient distribution strategy, utilizing comments on public GitHub repositories.

These comments typically contain links to encrypted archives hosted on mediafire[.]com, accompanied by a password—often the generic “changeme.”

Once users download and unpack these archives, their data becomes vulnerable to theft. While GitHub is actively working to remove these malicious comments, the volume of posts makes it challenging to keep up.

Attackers continuously add new comments, often outpacing removal efforts. Nonetheless, GitHub’s response has shown progress, with a noticeable increase in comment deletions.

One notable aspect of this campaign is the poor quality of English used in the comments. While this can serve as a red flag, future attacks may become more polished as cybercriminals leverage generative AI tools to craft convincing messages.

This evolution could make it increasingly difficult for users to distinguish between legitimate and malicious content.

Unfortunately, GitHub is not the only platform being exploited. Similar campaigns have been observed on YouTube, where Lumma Stealer and other information stealers are distributed.

Attackers often use different passwords and hosting platforms, like Dropbox, to spread their malware.

These campaigns masquerade as “Fake Tutorials,” luring users with promises of free software, only to infect their devices.

Vigilance is key when interacting with comments or links on platforms like GitHub and YouTube.

Trust your instincts and avoid clicking on dubious links if something seems suspicious. By sharing intelligence on threats like Lumma Stealer, we empower individuals and organizations to safeguard their digital environments proactively.

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN - 14 day free trial