Lumma Stealer activity resurges with new browser fingerprinting tactic

Rafi Mahmood

Observed in the wild

• On 13 November, Trend Micro reported that Lumma Stealer, an information-stealing malware offered as Malware-as-a-Service (MaaS), has seen an increase in activity following a prior decline caused by the doxxing of its alleged core members. The malware now incorporates browser fingerprinting into its command-and-control (C&C) tactics, supplementing traditional protocols.
• The fingerprinting mechanism uses JavaScript payloads to collect detailed system, hardware, and browser data (e.g., WebGL, Canvas, Audio context, WebRTC) and exfiltrates it via stealthy HTTP communications to dedicated endpoints. This enables environment profiling, evasion of sandboxes, and selective payload deployment.
• Lumma Stealer continues to employ process injection and maintains its established C&C structure while layering new capabilities.
• Organisations are advised to restrict software installation where possible, enforce MFA across all accounts, educate users on phishing awareness and fake CAPTCHA prompts, and monitor for suspicious API calls and fingerprinting activity.

Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics | Trend Micro (US)