Lumma Stealer Activity Drops After Doxxing

Lumma Stealer activity has declined in the wake of an underground doxxing campaign that exposed the identities of five alleged core group members, according to SecurityWeek. The doxxing, which published personal details including passport numbers and bank information on a site named Lumma Rats, coincided with a sharp drop in the malware’s command-and-control activity.

Trend Micro notes that this doxxing campaign appears to have driven significant changes in Lumma Stealer’s infrastructure and communications, with the group’s Telegram account reportedly compromised as a result. The shift has seen rivals such as Vidar and StealC emerge as top replacement options, and the pay-per-install service Amadey used to distribute Lumma Stealer has also been affected.

The article highlights that the accuracy of the doxed information and the named individuals’ involvement has not been independently verified, and attribution should be treated with caution.