Lumma Stealer Phishing Campaign: Avoiding Copyright Notice Decoys

Campaign Overview: Malicious Copyright Infringement Notices

Phishing actors are increasingly leveraging legal threats to manipulate victims into downloading malicious payloads. According to Dark Reading, a widespread campaign is currently targeting the healthcare, government, hospitality, and education sectors globally. The attackers utilize fraudulent copyright infringement notices, a tactic that creates a sense of urgency and legal fear to bypass a user’s typical security caution.

The primary objective of this activity is the delivery of information stealers (infostealers), including Lumma Stealer and Meduza Stealer. These tools are designed to exfiltrate sensitive data such as browser credentials, cryptocurrency wallets, and system information to a remote C2 server, which can later be used for follow-on attacks.

Technical Analysis and Infection Chain

The attack begins with a deceptive email claiming that the recipient has used copyrighted material without authorization. These emails often appear professional and authoritative, frequently mimicking legal firms or digital rights management organizations to ensure compliance from the target.

Lumma Stealer Phishing Campaign Detection and Delivery

To increase the likelihood of success and bypass traditional email security filters, the attackers host their malicious files on legitimate cloud storage platforms. By using services like Dropbox, OneDrive, or Discord’s CDN, the IoC signatures associated with the download URL often appear benign to automated scanning tools. This abuse of trusted infrastructure makes detection more difficult for perimeter defenses.

The link in the email typically directs the victim to a password-protected ZIP or ISO file. Password protection serves two purposes: it prevents automated sandbox analysis from inspecting the contents and adds a layer of authenticity to the legal package. Once the victim extracts the file, they find an executable masquerading as a document or a PDF. When executed, the malware begins its discovery phase, harvesting data before transmitting it to the attacker’s infrastructure.

Evasion Tactics and Victim Targeting

This campaign stands out due to its broad geographical reach and sector-specific targeting. By focusing on healthcare and government entities, the attackers seek high-value credentials that can be sold on underground forums or used for Lateral Movement within sensitive networks.

The malware authors employ several TTP sets to maintain persistence and avoid detection by EDR solutions. These include string obfuscation to hide the true intent of the code from static analysis, and anti-virtual machine checks to ensure the malware does not run in a research environment. In many cases, these infostealers serve as a precursor to more damaging Ransomware deployments.

Strategic Recommendations for Defenders

Understanding how to prevent infostealer infections via email requires a multi-layered defense strategy that combines technical controls with robust user awareness programs. Organizations should map these threats against the MITRE ATT&CK framework to identify gaps in their current detection capabilities.

Enhancing Detection and Response

Security teams should prioritize the following actions to mitigate the risk:

• Email Filtering: Configure gateways to flag or block password-protected archive files from external sources, especially when hosted on public cloud providers.
• Endpoint Monitoring: Use SOC resources to monitor for unusual outbound connections to known infostealer C2 infrastructures and identify unauthorized execution of script interpreters or unknown binaries.
• User Education: Train employees to recognize that legitimate legal notices regarding copyright infringement will rarely involve password-protected archives hosted on consumer cloud platforms.

Protecting Healthcare from Social Engineering Attacks

Given the sensitive nature of patient data, healthcare organizations must implement Zero Trust principles, ensuring that no user or device is trusted by default. Implementing strict application control policies can prevent the execution of unauthorized binaries delivered through these phishing decoys, effectively stopping the infection chain at the execution phase.