Lumma Infostealer Malware Attacks Users to Steal Browser Cookies, Cryptocurrency Wallets and VPN/RDP Accounts

Cybersecurity: Lumma Infostealer Overview

Since its emergence in August 2022, Lumma Infostealer has become a notable component of malware-as-a-service platforms, facilitating credential theft by various threat actors.

Lumma Infostealer is primarily delivered through phishing websites disguised as cracked software installers. It utilizes a Nullsoft Scriptable Install System (NSIS) package to avoid detection by signature-based security systems.

Upon execution, the malware reassembles fragmented AutoIt modules in memory and utilizes process hollowing to load obfuscated shellcode. This method replaces a legitimate process with the malware, disguising its activities as a benign executable.

Genians analysts identified Lumma Infostealer following a significant increase in credential theft reports in September 2025. Victims from both consumer and enterprise sectors reported unauthorized access to web sessions, remote desktop services, and digital asset wallets.

The malware steals browser cookies and account tokens, enabling seamless session hijacking and often bypassing multi-factor authentication. Cryptocurrency wallets stored in local databases, along with VPN and RDP credentials from configuration files, are exfiltrated to command-and-control (C2) domains via encrypted channels.

The stolen data significantly increases the risks of identity fraud, financial loss, and extensive network breaches.

Lumma Infostealer employs a layered installer to bypass conventional security scanners. The NSIS installer drops a ZIP archive into the Temp directory, and a command-line script extracts a disguised Cabinet file. Components including fragments of an AutoIt script and its interpreter are merged into a single executable.

; Fragment of AutoIt loader Run("cmd.exe /c Contribute.docx") _ConsoleWrite("Launching AutoIt mode...") _ProcessCreate("Riding.pif", "", @SystemDir, 0, $pi) _WinAPI_WriteProcessMemory($pi.hProcess, $remoteAddr, $shellcode, BinaryLen($shellcode)) _WinAPI_SetThreadContext($pi.hThread, $context) _WinAPI_ResumeThread($pi.hThread)

The installer circumvents heuristic defenses by checking for security processes and adjusts execution accordingly. After injection, the malware decrypts C2 domains and establishes encrypted channels for data exfiltration.

To counter Lumma Infostealer, enhancing endpoint detection and response (EDR) systems with behavior-based analytics and threat intelligence integration is crucial. Monitoring process injection events, routinely auditing installer behaviors, and enforcing application allowlisting policies are recommended.

Implementing network-level blocks for known C2 domains and using sandbox detonation for suspicious NSIS packages can further mitigate the threat posed by this malware.

Based on reporting by Cyber Security News.