Lumma Stealer Malware: A New Phishing Threat Distributing via Fake Verification Pages

[priyasng]

A recently identified malware named "Lumma Stealer" is making its way to users' devices through a cunning phishing method involving fake human verification pages. Cybersecurity researchers from CloudSEK have raised alarms about this malware that primarily targets Windows devices, aiming to steal sensitive information. Several phishing websites have been uncovered that trick users into downloading this malware by impersonating verification processes.

How Lumma Stealer is Spread

Lumma Stealer was first detected by Unit42 at Palo Alto Networks, but recent findings by CloudSEK indicate a wider distribution network than initially thought. The attackers have created a series of fraudulent websites, featuring a fake human verification system that mimics Google's CAPTCHA system. However, unlike genuine CAPTCHA pages that require simple actions like checking a box, these fake pages prompt users to run unusual commands.
In one reported case, the verification page directed users to execute a PowerShell script. This script contained commands that fetched content from a remote server, downloading a file that ultimately infected the Windows system with Lumma Stealer.

Identified Malicious URLs

Researchers have identified several URLs actively distributing Lumma Stealer. Some of these malicious websites include:

1. hxxps[://]heroic-genie-2b372e[.]netlify[.]app/please-verify-z[.]html
2. hxxps[://]fipydslaongos[.]b-cdn[.]net/please-verify-z[.]html
3. hxxps[://]sdkjhfdskjnck[.]s3[.]amazonaws[.]com/human-verify-system[.]html
4. hxxps[://]verifyhuman476[.]b-cdn[.]net/human-verify-system[.]html
5. hxxps[://]newvideozones[.]click/veri[.]html
6. hxxps[://]ch3[.]dlvideosfre[.]click/human-verify-system[.]html

It's crucial to note that this list is not exhaustive, and there could be more websites distributing the malware.

Techniques Used by Attackers

Attackers are leveraging content delivery networks (CDNs) to spread these fake verification pages, utilizing base64 encoding and clipboard manipulation to evade detection. While no other malware has been reported using this method yet, the possibility of such expansion exists.

Mitigating the Threat of Lumma Stealer

As this attack relies on phishing techniques, traditional security patches won't necessarily prevent infection. However, there are several steps organizations and users can take to protect against Lumma Stealer:
Awareness and Training: Educate users and employees about the risks of this phishing tactic and the dangers of executing commands from unverified sources.
Endpoint Protection: Implement and maintain reliable endpoint protection solutions capable of detecting and blocking PowerShell-based attacks.
System Updates: Regularly update and patch systems to minimize vulnerabilities that Lumma Stealer could exploit.

Conclusion

Lumma Stealer presents a sophisticated phishing threat by tricking users into executing commands that lead to infection. With its ability to bypass traditional security measures through social engineering, it emphasizes the need for awareness and proactive defense strategies. Organizations should ensure robust endpoint protection and train users to recognize and avoid these deceptive tactics.

[Syed_Nabi23]

Informative thread  

[RD.•°]

Great 

[CtrlAltWin]

Phishing schemes like Lumma Stealer are getting increasingly sophisticated. Always be cautious about executing commands from unknown sources, and ensure your endpoint protection is up to date. Awareness is crucial!

[Syed_Nabi23]

Security main

[Mightykibu]

Thanks for the awareness