New Luma Infostealer Malware Steals Browser Data, Cryptocurrency, and Remote Access Accounts

Cybersecurity: Luma Infostealer Threat Analysis

Luma Infostealer, a malware-as-a-service (MaaS) offering, represents a significant threat by targeting high-value credentials such as web browser cookies, cryptocurrency wallets, and VPN/RDP account information. This malware is utilized by threat actors in the initial stages of complex campaigns, including ransomware deployment, account hijacking, and internal network compromise.

The data stolen by Luma Infostealer facilitates identity theft, financial fraud, and corporate intrusions. Enhancing endpoint detection and response (EDR) systems with behavior-based detection and threat intelligence is crucial for effective defense.

In recent years, infostealer malware has become a primary high-risk vector for individuals and organizations. These threats operate covertly on victims’ endpoints, collecting sensitive information without user awareness. The stolen data is often sold on dark-web marketplaces and contributes to subsequent malicious activities such as identity theft and financial exploitation.

Genians Security Center (GSC) has identified Lumma Infostealer, which is packaged and distributed using the Nullsoft Scriptable Install System (NSIS).

Malware-as-a-Service enables attackers to rent or subscribe to fully managed malware platforms. Luma Infostealer exemplifies this model, offering easy accessibility via dark-web channels and modular customization of payloads and command-and-control (C2) connection methods. MaaS providers manage development, infrastructure, and updates, while users execute campaigns and resell stolen data, regardless of technical skill.

This model lowers barriers to entry for cybercrime, expands attack scale through affiliate networks, and complicates attribution as identical malware is deployed by multiple actors. Since its debut in August 2022, Luma has been distributed via phishing sites masquerading as cracked software.

Analysis by Genian Security Center reveals a multi-stage infection chain: NSIS installers drop fragmented AutoIt modules, reassemble obfuscated shellcode in memory, and employ process hollowing to execute the infostealer under legitimate process disguises. Frequent updates and variable distribution URLs challenge traditional signature-based detection, highlighting the need for behavior-based EDR.

Traditional antivirus solutions struggle to detect Luma’s obfuscation and process injection techniques. In contrast, modern EDR platforms excel at identifying suspicious behaviors such as in-memory shellcode execution and unusual process hollowing events. Integrating real-time threat intelligence enables security teams to correlate emerging indicators and swiftly adapt detection rules.

Organizations should enforce multi-factor authentication for all critical accounts, discourage credential storage in browsers, and monitor network anomalies indicative of lateral movement or data exfiltration. Luma Infostealer demonstrates how MaaS offerings can democratize sophisticated attack capabilities, placing high-value credentials at risk and facilitating larger attack chains, including ransomware and network infiltration.

To counter these threats, organizations must adopt EDR solutions capable of behavior-based detection, leverage threat intelligence feeds, and implement strict authentication and monitoring policies. By focusing on the detection of anomalous endpoint behaviors and continually updating defense strategies, security teams can thwart Luma-driven attacks and protect sensitive assets from exploitation.

Based on reporting by GBHackers.