The old LummaStealer is back.

The old LummaStealer is back. This time, Trendy used ClickFix to embed malware into the bait machine.

The most famous type of malware stealing data from the victim's machine or Infostealer is probably inevitable. LummaStealer and the most popular current malware release method mentioned must be ClickFix. Using a fraudulent malware notification screen to do the malware installation command, many parties may think about what it would be like if these two came together and now it happens.

According to a report by the website Cyber Security News, a new LummaStealer malware distribution campaign was detected through a popular method like ClickFix through the use of fake CaptCha. A research team from Bitdefender, a company that develops anti-malware tools, revealed that hackers will use fake websites that claim to be Crack sites, video games, and software to be available for free. Or they may claim to be pirated movie downloading sites. When the victim enters the site and encounters fake CaptCha and follows the instructions made on the screen, CaptCha will lead to downloading malware. It's named CastleLoader in the end.

By malware, CastleLoader serves as a base for downloading and installing LummaStealer malware. It works through AutoIT to hide malware code and check the Obfuscation system with random word variables and Dead Code. In the next step, before loading the LummaStealer's payload, the malware will check the system environment first to make sure it runs on the victim's machine, not in a simulated environment like the Sandbox system, VMware, or VirtualBox, by checking the computer name or user name. If found running in the environment, the malware will stop immediately. In addition, the malware has created fake domain names that do not exist to deceive the DNS Lookup monitoring system.

And if everything is safe, this malware will create persistence on the system by copying itself into the Local Application Data folder (% LOCALAPPDATA%) and creating a shortcut inside the Startup folder to guarantee that the malware will be activated every time it is rebooted.

For LummaStealer malware, the malware focuses on Windows operating system users. The malware is effective at stealing various forms of data, such as web browser passwords, Session Cookies files, Kryptokerrency wallet information, or even Token for double-layer authentication (2FA or 2 Factors Authentication).

# Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack # lummastealer