Lumma Stealer Leverages Browser Fingerprinting for Data Theft and Stealthy C2 Communications

Lumma Stealer has evolved to use browser fingerprinting as part of its data theft and stealthy C2 communications, supplementing its existing HTTP-based exfiltration with JavaScript-driven collection. According to Trend Micro, which tracks Lumma Stealer as Water Kurita, the malware now communicates with a dedicated fingerprinting endpoint at /api/set_agent on its C&C domain, sending a 32-character hexadecimal identifier, a session token and browser details in initial requests.

The fingerprinting script gathers system and browser characteristics, including WebGL, canvas and audio context data, and transmits this information in JSON before redirecting the browser to about:blank to minimise user awareness. Trend Micro’s analysis shows the malware continuing to use traditional C2 parameters such as uid and cid, while also performing more covert profiling and process injection techniques, notably remote thread injection from MicrosoftEdgeUpdate.exe into legitimate Chrome processes.

The new capabilities appear designed to help identify victim environment characteristics, evade detection and tailor follow-on actions, with operators maintaining the existing C2 structure for compatibility. Published telemetry from October 20, 2025, signalled a resurgence in Lumma Stealer activity after a period of decline following doxxing of its core members.