Lumma Stealer, also known as Water Kurita, has resurfaced with new tactics after an initial drop in activity following the public disclosure of its core members' identities. Since late October 2025, it has employed browser fingerprinting in conjunction with its traditional command-and-control approaches to evade detection, gather extensive data on the victim's environment, and maintain operational continuity. The malware injects itself into trusted browser processes, collects detailed system and browser information via JavaScript, and sends this data back to its command-and-control (C&C) servers stealthily. Despite some operational setbacks and reduced public presence, Lumma Stealer remains active, with operators likely keeping a low profile to avoid further scrutiny. Organizations are advised to enhance email vigilance, restrict software installations, monitor for suspicious CAPTCHA behaviors, and utilize MFA, while Trend Vision One tools detect and aid in identifying relevant compromise indicators.
https://www.trendmicro.com/en_us/research/25/k/lumma-stealer-browser-fingerprinting.html
