Lumma, RedLine and Vidar Infostealers Fuel Cloud Credential Theft Campaigns
Lumma, RedLine, and Vidar steal cloud and developer credentials, enabling session hijacking that bypasses MFA.
62
Threat actor
JINX-0164
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 25, 2026
- Last mentionedSep 28, 2026
Timeline
2 articles · newest firstThe Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz finds Lumma, RedLine, and Vidar dominate infostealer theft of AWS, GitHub, and OpenAI credentials from endpoints.
64
Appears with
- Googlevendor · 2
- NordStellarorganization · 2
- GitLabvendor · 2
- GitHubproduct · 2
- Vidarmalware · 2
- GitLabproduct · 2
- Miasmamalware · 2
- Verizonorganization · 2
- Wizorganization · 2
- Microsoftvendor · 2
- Microsoft Azureproduct · 1
- Amazonvendor · 1
- AWSproduct · 1
- AWS CLIproduct · 1
- Google Cloud Platformproduct · 1
- Microsoftorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.