Lumma Infostealer MaaS Campaign Uses NSIS/AutoIt and MEGA Cloud to Steal Credentials via Pirated Software

Lumma Infostealer has evolved into a MaaS-capable threat, with researchers from the Genians Security Center (GSC) identifying an active campaign that uses NSIS installers, AutoIt modules, and MEGA cloud infrastructure to distribute credential-stealing malware disguised as pirated software. The campaign begins with phishing sites impersonating cracked software portals, redirecting users to MEGA-hosted payloads to bypass URL filtering.

The payload arrives as an encrypted ZIP containing a malicious NSIS installer named setup.exe, which embeds AutoIt code and shellcode fragments that reassemble upon execution. After deployment, the malware uses Process Hollowing to inject Lumma Infostealer into memory, then decrypts its C2 domains and transmits stolen data to remote servers.

The attackers’ infrastructure includes several C2 domains and IPs and the malware targets web browser credentials (Chrome, Edge), email data (Outlook, Telegram), cryptocurrency wallets, VPN/RDP credentials, and remote‑access software configurations. Infections are noted as a high‑risk vector, with stolen data traded on the Dark Web for identity theft and financial fraud, and Lumma’s MaaS model described as lowering entry barriers for cybercrime.