Microsoft files legal action against information-stealing malware Lumma Stealer

Microsoft said Wednesday that it has broken down the Lumma Stealer malware project with the assistance of law enforcement officers throughout the world.

The tech giant said in a blog post that its digital crimes unit discovered more than 394,000 Windows computers were infected by the Lumma malware worldwide between March 16 through May 16.

In a coordinated follow-up operation this week, Microsoft’s Digital Crimes Unit (DCU), Europol, and international partners have disrupted Lumma’s technical infrastructure, cutting off communications between the malicious tool and victims. Furthermore, approximately 1,300 domains seized or transferred to Microsoft, including 300 names taken by law enforcement with the assistance of Europol, will be routed to Microsoft sinkholes.

The Lumma malware was a favorite hacking tool used by bad actors, Microsoft said in the post. Hackers used the software to steal passwords, credit cards, bank accounts, and cryptocurrency wallets.

Microsoft said its digital crimes unit was able to dismantle the web domains underpinning Lumma’s infrastructure with the help of a court order from the U.S. District Court for the Northern District of Georgia.

Microsoft stated that other technology providers, such as Cloudflare, Bitsight, and Lumen, also contributed to the breakdown of the Lumma malware ecosystem.

Hackers have been buying the Lumma malware via underground online forums since at least 2022, all while developers were “continually improving its capabilities,” the blog post said.

Additionally, Microsoft said that hackers have used Lumma to attack online gaming communities and education systems, while other cybersecurity companies have noted that the malware has been used in cyberattacks targeting manufacturing, logistics, health care and other related critical infrastructure.

The business expects attackers to attempt to rebuild.  Microsoft says it will keep working with law enforcement and tech partners to track new threats, improve security, and stop future attacks. The business also intends to utilize the stolen domains to gather intelligence that will assist others tighten their security.

Microsoft says computer users should protect themselves from malware like Lumma by turning on multi-factor authentication, keeping antivirus software up to date, and being careful with email links and attachments.