Unveiling the Lumma Password Stealer Attack: Infection Chain and Escalation Tactics Exposed

Lumma, a sophisticated C++-based information stealer, has surged in prevalence over recent years, posing significant risks to both individuals and organizations by exfiltrating sensitive data such as browser credentials, cryptocurrency wallets, and personal files.

Developed since December 2022 and distributed as Malware-as-a-Service (MaaS) via Telegram channels with tiered subscriptions, Lumma relies on initial access brokers (IABs) who exploit leaked credentials or phishing campaigns to facilitate breaches.

According to ENISA, IABs form a critical link in modern attack chains, often chaining with ransomware operations.

Threat Landscape

Despite a major disruption in 2025 by the US Department of Justice, Europol, and Japan’s Cybercrime Center, which seized Lumma’s infrastructure and identified over 394,000 infected Windows devices between March and May 2025 per Microsoft Threat Intelligence, the malware persists, adapting tactics to evade detection.

Its fully undetectable (FUD) status is maintained through mandatory packing, ensuring the core payload remains obfuscated until runtime, highlighting the evolving nature of infostealer threats in the cyber landscape.

The analyzed Lumma sample, observed in February 2025, begins with a 32-bit .NET/C# loader that verifies its own PE structure by checking DOS and PE headers, extracting and decrypting a .CODE section using VirtualProtect for RWX permissions and CallWindowProcA for execution.

This stage spawns a suspended process via CreateProcessW with CREATE_SUSPENDED flags, allocates memory with VirtualAllocEx, and injects decrypted payloads by mapping PE sections (.text, .rdata, .data, .reloc) into the target process using WriteProcessMemory, followed by SetThreadContext and ResumeThread for remote injection.

In-Depth Infection Chain

According to the report, the unpacked stage employs control flow flattening, Heaven’s Gate to switch between x86 and x64 modes for syscalls like NtRaiseHardError, and pre-flight checks including file integrity verification against a 20-byte signature and OS language (excluding Russian systems via GetUserDefaultUILanguage).

Post-checks involve resolving APIs from ntdll, kernel32, user32, ws2_32, and winhttp via PEB parsing and hash-based lookups, decrypting C2 domains with ChaCha20, and initiating POST requests (e.g., “act=life”) over HTTPS port 443 using WinHttp functions to fetch configurations.

This multi-stage chain evades EDR by focusing on behavioral patterns rather than atomic indicators, as noted in WithSecure’s layered detection approach.

Lumma’s tactics underscore the need for advanced threat hunting, emphasizing behavioral monitoring over signature-based defenses.

By outsourcing loaders and requiring packing, it prolongs FUD status, while its exfiltration of browser data enables lateral movement and impersonation.

Defenders should track evolving TTPs, such as PE header manipulation and syscall abuse, to disrupt similar infostealers, ensuring robust credential management and endpoint security to mitigate IAB-facilitated breaches.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!