Storm-1865 used ClickFix and Booking.com lures against hotels
Fake CAPTCHA pages pushed mshta commands that installed stealers and RATs; Booking.com says its own systems were not breached.
36
Malware
Lumma Stealer
- Mentions · 7d1
- Mentions · 30d4
- All mentions10
- First seenSep 6, 2026
- Last mentioned4d ago
Timeline
10 articles · newest firstClickFix campaign uses Windows finger to install Lumma
A sponsored Google result for “amazon business” opens a fake login and CAPTCHA that launches finger.exe and NetSupport.
64
Amazon-themed ClickFix uses finger.exe to deliver stealers
Huntress tied the chain to at least three customers; a macOS script URL was offline during research.
66
Roundup cites infostealers, malicious packages and ClickFix as rising malware trends
Immersive says Lumma Stealer, StealC and RisePro now account for 75% of stolen credentials sold for initial access.
34
Hackers Don’t Need to Break Into the Cloud When They Can Steal the Keys
Wiz says Lumma, RedLine, and Vidar stealers are harvesting cloud, code, and AI credentials.
73
The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz finds Lumma, RedLine, and Vidar dominate infostealer theft of AWS, GitHub, and OpenAI credentials from endpoints.
64
The Top 4 Threats We Found by Investigating Every Alert for a Quarter
Prophet Security's quarterly threat report finds identity attacks made up roughly half of confirmed malicious activity, with stolen authenticated sessions bypassing conditional access controls.
52
Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA
Okta finds infostealer logs contain thousands of replayable AI session tokens and API keys, letting criminals bypass MFA and access services from Google, Anthropic and OpenAI.
60
Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data
Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.
62
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.
45
Appears with
- Googlevendor · 5
- Microsoftvendor · 5
- Vidarmalware · 4
- Huntressorganization · 3
- fingerproduct · 2
- AsyncRATmalware · 2
- Gen Digitalvendor · 2
- Anthropicorganization · 2
- Claudeproduct · 2
- GitHubvendor · 2
- NetSupport Clientmalware · 2
- Windowsproduct · 2
- Amazon Web Servicesvendor · 2
- Cursorproduct · 2
- RedLine Stealermalware · 2
- Wizorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.