Know What's Happening in Cybersecurity

Once-Hobbled Lumma Stealer Is Back with Lures that Are Hard to Resist

Lumma Stealer has reemerged at scale after a 2025 law‑enforcement takedown that crippled its command‑and‑control infrastructure. The malware‑as‑a‑service operation now relies on ClickFix lures—fake CAPTCHAs that trick users into running malicious commands—and the memory‑only CastleLoader to evade detection. Researchers report that the rebuilt infrastructure leverages trusted CDNs such as Steam Workshop and Discord, allowing rapid distribution of credential‑stealing payloads to Windows machines worldwide.