Microsoft, on May 21, announced that conducted a major takedown operation against Lumma Stealer, a malware designed to steal sensitive information from popular web browsers like Google Chrome, Mozilla Firefox and Microsoft Edge. In a blog post, Microsoft said that between March 16 and May 16, 2025, they identified more than 394,000 Windows PCs infected by the Lumma malware.
What is Lumma Stealer?
Lumma Stealer operates as “Malware-as-a-Service” and is pretty easy to distribute and difficult to detect by traditional security defences, making it a preferred tool for cybercriminals and threat actors to steal data. Often deployed via spear-phishing emails and malvertising, the malware impersonates trusted brands like Microsoft.
The info-stealing malware, which affects popular browsers like Google Chrome, Microsoft Edge and Mozilla Firefox, is designed to steal information like cryptocurrency wallets, credit card details, bank account information and passwords.
First discovered in 2022, Lumma Stealer is also associated with ransomware attacks, school security system breaches, and even used for stealing information or money from financial institutions.
Advertisement
The takedown operation, conducted by Microsoft’s Digital Crimes Unit in coordination with numerous law enforcement agencies across the world like the U.S Department of Justice, Europol and Japan’s Cybercrime Control Centre (JC3), has already seized more than 2,300 domains that acted as the backbone of Lumma’s infrastructure. The U.S. Department of Justice has announced that it seized the central command structure for Lumma and disrupted the underground marketplaces where the malware was being sold.
For those wondering, Microsoft says Lumma Stealer is one of the “leading tools” used by cybercriminals around the world to steal information and money on a large scale.
Lumma Stealer was first discovered in 2022. (Image Source: Microsoft Designer/AI) 
Share
