New Luma Infostealer Malware Steals Browser Data, Cryptocurrency, and Remote Access Accounts

Luma Infostealer, described as a malware-as-a-service (MaaS) offering, has emerged as a potent threat targeting high-value credentials such as web browser cookies, cryptocurrency wallets, and VPN/RDP account information. Beyond isolated theft, threat actors are using Luma in the initial infiltration stages of campaigns that lead to ransomware deployment, account hijacking, and internal network compromise.

The stolen data fuels identity theft, financial fraud, and corporate intrusions, prompting calls for strengthened endpoint detection and response through behaviour-based detection and threat intelligence integration. Genian Security Center identified Lumma Infostealer, a malware packaged and distributed using NSIS, with an infection chain involving NSIS installers dropping fragmented AutoIt modules, memory-resident obfuscated shellcode, and process hollowing to run the infostealer under legitimate processes.

Since its debut in August 2022, the malware has been distributed via phishing sites masquerading as cracked software and via redirection to cloud storage like MEGA, where a password-protected ZIP contains the setup.exe and dummy files.