Microsoft has filed a legal action to disrupt the operations of Lumma Stealer, an advanced piece of information-stealing malware that has infected nearly 400,000 Windows computers worldwide over the past two months, the company said Wednesday.
The action was led by Microsoft’s Digital Crimes Unit (DCU) and involved a court order from the U.S. District Court for the Northern District of Georgia, enabling the takedown, suspension, and blocking of malicious domains that formed the malware’s core infrastructure.
“The growth and resilience of Lumma Stealer highlight the broader evolution of cybercrime and underscore the need for layered defenses and industry collaboration,” Microsoft said in a blog post.
Malware Capabilities
Lumma Stealer targets a wide range of sensitive user data:
-
Extracts information from web browsers, including saved passwords
-
Harvests credentials from cryptocurrency wallets
-
Installs additional malware on compromised systems
It operates as part of a larger cybercrime-as-a-service network, offering malicious tools to third parties for use in data theft and system compromise.
Federal Action and Domain Seizures
In parallel to Microsoft’s civil action:
-
The U.S. Department of Justice announced the seizure of five internet domains tied to the LummaC2 malware infrastructure
-
The FBI’s Dallas Field Office is leading the ongoing criminal investigation
These efforts aim to disrupt the malware’s operations and prevent further infections globally.
Broader Implications
The Lumma Stealer case highlights growing concerns over modular, stealthy malware strains designed to:
-
Evade detection
-
Monetize stolen data
-
Enable subsequent attacks
Microsoft emphasized the need for:
-
Layered cybersecurity defenses
-
Cross-industry cooperation
-
Judicial interventions to combat evolving digital threats
This case adds to a growing list of Microsoft-led legal and technical takedowns aimed at dismantling global cybercrime infrastructure, including recent actions against Storm botnets and ransomware operators.