ONCE-HOBBLED LUMMA STEALER IS BACK WITH LURES THAT ARE HARD TO RESIST

Summary from the TLDR InfoSec newsletter

Law enforcement crippled Lumma Stealer's infrastructure in 2025, but the infostealer has rapidly rebuilt and is spreading again using persuasive “ClickFix” fake CAPTCHA prompts that trick users into running commands in Windows Terminal, loading CastleLoader in memory, then Lumma.