Itch.io Targeted: Lumma Stealer Deployed Via Fake Updates and Reflective Node.js Loader

A sophisticated malware campaign has infiltrated the indie gaming platform Itch[.]io, using deceptive “game update” lures to distribute Lumma Stealer, according to G DATA Security Lab. Security researchers say threat actors are spamming the comments sections with links to fake updates, prompting users to download a password‑stealing payload. The attack begins with newly created Itch[.]io accounts flooding the comments of legitimate games, claiming to offer a “game update” hosted on Patreon.

The downloaded archive, named Updated Version[.]zip, contains a malicious loader in game.exe that is a Node.js application compiled into a single executable using nexe, enabling it to run JavaScript without Node.js being installed. When executed, the malware drops modules[.]node in the system temporary directory, which uses Node.js APIs (napi_create_function) to reflectively load the Lumma Stealer payload into memory.

Once active, Lumma Stealer harvests browser cookies and passwords, cryptocurrency wallet details, and system information, exfiltrating them to the attacker’s C2 server. December 10, 2025.