ClickFix campaign uses Windows finger to install Lumma
A sponsored Google result for “amazon business” opens a fake login and CAPTCHA that launches finger.exe and NetSupport.
Stories per day · 30 days
3 RSS
7 stories, newest first · one card per story
Stories tagged #lumma
Amazon-themed ClickFix uses finger.exe to deliver stealers
Huntress tied the chain to at least three customers; a macOS script URL was offline during research.
Hackers Don’t Need to Break Into the Cloud When They Can Steal the Keys
Wiz says Lumma, RedLine, and Vidar stealers are harvesting cloud, code, and AI credentials.
2
Lumma, RedLine and Vidar Infostealers Fuel Cloud Credential Theft Campaigns
Lumma, RedLine, and Vidar steal cloud and developer credentials, enabling session hijacking that bypasses MFA.
2
The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz finds Lumma, RedLine, and Vidar dominate infostealer theft of AWS, GitHub, and OpenAI credentials from endpoints.
4
Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA
Okta finds infostealer logs contain thousands of replayable AI session tokens and API keys, letting criminals bypass MFA and access services from Google, Anthropic and OpenAI.
2
Anthropic locks out Claude users after infostealers hijack login sessions
Anthropic invalidated Claude sessions compromised by infostealers such as Vidar, Lumma and Atomic Stealer, which steal browser cookies to bypass 2FA.
3