Lumma Stealer Resurfaces After Doxxing with New Browser Fingerprinting to Target High-Value Victims

Trend Micro researchers have observed a significant resurgence in Lumma Stealer activity, also tracked as Water Kurita, despite a targeted doxxing campaign last month that exposed the malware’s alleged core members and disrupted its operations. The resurgence is characterised by a major upgrade: browser fingerprinting embedded directly into Lumma’s command-and-control pipeline.

According to Trend Micro, the fingerprinting technique involves deploying JavaScript payloads to collect system, network, hardware, and browser data and exfiltrate it via stealthy HTTP communications, enabling Lumma to detect sandboxes, prioritise high-value victims and tune payloads accordingly. The operators continue to use process injection techniques to blend into browser activity, specifically remote thread injection from MicrosoftEdgeUpdate.exe into chrome.exe, to mask as legitimate browser processes.

Telemetry data indicates that starting the week of 20 October 2025 there was a notable uptick in Lumma activity, even as underground visibility declined and fraudulent Telegram accounts impersonating Lumma channels caused disruption among buyers and operators. Trend Micro notes that Lumma remains an active threat with continued endpoint targeting and the documented deployment of GhostSocks as a secondary payload, with operators keeping a low profile while awaiting opportunities to resume full-scale activities.