Malware Distributed Using Falcon Sensor Update Phishing Lure
Essential information
- Published
- 29/07/2024 11:40
- Modified
- 29/07/2024 12:04
- Tags
- 2024-07-29 lumma lumma stealer malspam phishing stealer
- Related entities
- 32 observables, 5 techniques (mitre), 1 malware
Description
CrowdStrike Intelligence uncovered a phishing campaign impersonating CrowdStrike and distributing malicious files containing a Microsoft Installer (MSI) loader. The loader executes the commodity stealer 'Lumma Stealer' packed with 'CypherIt'. This campaign is likely linked to a previous 'Lumma Stealer' distribution effort leveraging advanced social engineering techniques. The malware evades detection by terminating if security products are detected, and employs multiple layers of obfuscation. It ultimately connects to command and control servers to exfiltrate stolen data.