{
  "name": "Hundreds of fake Reddit sites push Lumma Stealer malware",
  "slug": "hundreds-of-fake-reddit-sites-push-lumma-stealer-malware",
  "description": "A widespread campaign involving nearly 1,000 fake web pages mimicking Reddit and WeTransfer has been discovered, aiming to distribute the Lumma Stealer malware. The attackers create convincing fake Reddit discussions and WeTransfer download pages to trick users into downloading the malicious payload. The campaign uses domain names that incorporate brand names with random characters to appear legitimate. Lumma Stealer is a sophisticated info-stealing tool capable of collecting passwords and session tokens, potentially leading to account hijacking. This type of malware has been implicated in recent high-profile attacks on various companies. The distribution methods for this campaign may include malvertising, SEO poisoning, and direct messages on social media.",
  "published": "2025-01-24T07:28:02+00:00",
  "created_at": "2025-01-24T07:28:02+00:00",
  "modified_at": "2025-01-24T08:09:32+00:00",
  "created_at_opencti": "2025-01-24T07:28:02+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-01-24",
    "lumma stealer",
    "reddit impersonation",
    "wetransfer impersonation"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "wettransfer99.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer99.tynd.org"
      },
      {
        "id": "",
        "name": "wettransfer99.rujy.org"
      },
      {
        "id": "",
        "name": "wettransfer98.haqx.org"
      },
      {
        "id": "",
        "name": "wettransfer98.gsxx.org"
      },
      {
        "id": "",
        "name": "wettransfer97.zghf.org"
      },
      {
        "id": "",
        "name": "wettransfer97.teqg.net"
      },
      {
        "id": "",
        "name": "wettransfer97.xirn.org"
      },
      {
        "id": "",
        "name": "wettransfer97.rmcz.org"
      },
      {
        "id": "",
        "name": "wettransfer97.qaru.org"
      },
      {
        "id": "",
        "name": "wettransfer97.qujh.org"
      },
      {
        "id": "",
        "name": "wettransfer97.lowk.org"
      },
      {
        "id": "",
        "name": "wettransfer97.fvhz.org"
      },
      {
        "id": "",
        "name": "wettransfer97.jyse.org"
      },
      {
        "id": "",
        "name": "wettransfer97.dbft.org"
      },
      {
        "id": "",
        "name": "wettransfer96.sxrz.org"
      },
      {
        "id": "",
        "name": "wettransfer96.nuxq.net"
      },
      {
        "id": "",
        "name": "wettransfer96.lowk.org"
      },
      {
        "id": "",
        "name": "wettransfer95.wyru.org"
      },
      {
        "id": "",
        "name": "wettransfer95.rrxk.org"
      },
      {
        "id": "",
        "name": "wettransfer94.teqg.net"
      },
      {
        "id": "",
        "name": "wettransfer94.lxtf.org"
      },
      {
        "id": "",
        "name": "wettransfer93.zghf.org"
      },
      {
        "id": "",
        "name": "wettransfer93.rujy.org"
      },
      {
        "id": "",
        "name": "wettransfer93.qibx.org"
      },
      {
        "id": "",
        "name": "wettransfer92.fdwn.org"
      },
      {
        "id": "",
        "name": "wettransfer92.dyxk.net"
      },
      {
        "id": "",
        "name": "wettransfer91.gsxx.org"
      },
      {
        "id": "",
        "name": "wettransfer91.fvhz.org"
      },
      {
        "id": "",
        "name": "wettransfer90.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer90.teqg.net"
      },
      {
        "id": "",
        "name": "wettransfer90.sxrz.org"
      },
      {
        "id": "",
        "name": "wettransfer90.rujy.org"
      },
      {
        "id": "",
        "name": "wettransfer90.qujh.org"
      },
      {
        "id": "",
        "name": "wettransfer90.nuxq.net"
      },
      {
        "id": "",
        "name": "wettransfer90.dbft.org"
      },
      {
        "id": "",
        "name": "wettransfer90.ckfb.org"
      },
      {
        "id": "",
        "name": "wettransfer89.teqg.net"
      },
      {
        "id": "",
        "name": "wettransfer89.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer89.rujy.org"
      },
      {
        "id": "",
        "name": "wettransfer89.lxtf.org"
      },
      {
        "id": "",
        "name": "wettransfer89.lowk.org"
      },
      {
        "id": "",
        "name": "wettransfer89.gsxx.org"
      },
      {
        "id": "",
        "name": "wettransfer89.fyxy.net"
      },
      {
        "id": "",
        "name": "wettransfer88.xoqu.org"
      },
      {
        "id": "",
        "name": "wettransfer88.tynd.org"
      },
      {
        "id": "",
        "name": "wettransfer88.sxrz.org"
      },
      {
        "id": "",
        "name": "wettransfer87.zjvm.org"
      },
      {
        "id": "",
        "name": "wettransfer87.nuxq.net"
      },
      {
        "id": "",
        "name": "wettransfer87.rmcz.org"
      },
      {
        "id": "",
        "name": "wettransfer87.lowk.org"
      },
      {
        "id": "",
        "name": "wettransfer86.xoqu.org"
      },
      {
        "id": "",
        "name": "wettransfer87.jyse.org"
      },
      {
        "id": "",
        "name": "wettransfer86.nuxq.net"
      },
      {
        "id": "",
        "name": "wettransfer86.gsxx.org"
      },
      {
        "id": "",
        "name": "wettransfer86.fkfy.org"
      },
      {
        "id": "",
        "name": "wettransfer86.dyxk.net"
      },
      {
        "id": "",
        "name": "wettransfer84.zplg.org"
      },
      {
        "id": "",
        "name": "wettransfer85.gsxx.org"
      },
      {
        "id": "",
        "name": "wettransfer84.wojq.net"
      },
      {
        "id": "",
        "name": "wettransfer84.gsxx.org"
      },
      {
        "id": "",
        "name": "wettransfer84.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer84.fkfy.org"
      },
      {
        "id": "",
        "name": "wettransfer84.dghj.org"
      },
      {
        "id": "",
        "name": "wettransfer84.dyxk.net"
      },
      {
        "id": "",
        "name": "wettransfer83.xirn.org"
      },
      {
        "id": "",
        "name": "wettransfer82.gsxx.org"
      },
      {
        "id": "",
        "name": "wettransfer82.zghf.org"
      },
      {
        "id": "",
        "name": "wettransfer81.zghf.org"
      },
      {
        "id": "",
        "name": "wettransfer81.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer81.tynd.org"
      },
      {
        "id": "",
        "name": "wettransfer81.qujh.org"
      },
      {
        "id": "",
        "name": "wettransfer81.qibx.org"
      },
      {
        "id": "",
        "name": "wettransfer81.haqx.org"
      },
      {
        "id": "",
        "name": "wettransfer81.fkfy.org"
      },
      {
        "id": "",
        "name": "wettransfer80.xirn.org"
      },
      {
        "id": "",
        "name": "wettransfer80.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer80.tynd.org"
      },
      {
        "id": "",
        "name": "wettransfer79.zjvm.org"
      },
      {
        "id": "",
        "name": "wettransfer79.tynd.org"
      },
      {
        "id": "",
        "name": "wettransfer78.xtnw.org"
      },
      {
        "id": "",
        "name": "wettransfer78.vaqi.org"
      },
      {
        "id": "",
        "name": "wettransfer78.tqfa.org"
      },
      {
        "id": "",
        "name": "wettransfer78.rujy.org"
      },
      {
        "id": "",
        "name": "wettransfer78.haqx.org"
      },
      {
        "id": "",
        "name": "wettransfer78.fvhz.org"
      },
      {
        "id": "",
        "name": "wettransfer78.fkfy.org"
      },
      {
        "id": "",
        "name": "wettransfer77.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer77.qequ.org"
      },
      {
        "id": "",
        "name": "wettransfer77.qaru.org"
      },
      {
        "id": "",
        "name": "wettransfer77.nuxq.net"
      },
      {
        "id": "",
        "name": "wettransfer77.lowk.org"
      },
      {
        "id": "",
        "name": "wettransfer77.husf.org"
      },
      {
        "id": "",
        "name": "wettransfer77.gsxx.org"
      },
      {
        "id": "",
        "name": "wettransfer76.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer76.dbft.org"
      },
      {
        "id": "",
        "name": "wettransfer75.rujy.org"
      },
      {
        "id": "",
        "name": "wettransfer75.lxtf.org"
      },
      {
        "id": "",
        "name": "wettransfer75.lowk.org"
      },
      {
        "id": "",
        "name": "wettransfer75.jyse.org"
      },
      {
        "id": "",
        "name": "wettransfer75.gsxx.org"
      },
      {
        "id": "",
        "name": "wettransfer75.fkfy.org"
      },
      {
        "id": "",
        "name": "wettransfer75.dyxk.net"
      },
      {
        "id": "",
        "name": "wettransfer74.rrxk.org"
      },
      {
        "id": "",
        "name": "wettransfer74.lowk.org"
      },
      {
        "id": "",
        "name": "wettransfer74.fkfy.org"
      },
      {
        "id": "",
        "name": "wettransfer74.fdwn.org"
      },
      {
        "id": "",
        "name": "wettransfer74.dghj.org"
      },
      {
        "id": "",
        "name": "wettransfer74.dbft.org"
      },
      {
        "id": "",
        "name": "wettransfer72.zghf.org"
      },
      {
        "id": "",
        "name": "wettransfer72.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer72.qujh.org"
      },
      {
        "id": "",
        "name": "wettransfer72.jyse.org"
      },
      {
        "id": "",
        "name": "wettransfer72.fejw.org"
      },
      {
        "id": "",
        "name": "wettransfer71.xtnw.org"
      },
      {
        "id": "",
        "name": "wettransfer71.tqfa.org"
      },
      {
        "id": "",
        "name": "wettransfer71.rujy.org"
      },
      {
        "id": "",
        "name": "wettransfer71.qibx.org"
      },
      {
        "id": "",
        "name": "wettransfer71.lxtf.org"
      },
      {
        "id": "",
        "name": "wettransfer70.rujy.org"
      },
      {
        "id": "",
        "name": "wettransfer70.qujh.org"
      },
      {
        "id": "",
        "name": "wettransfer70.qezn.org"
      },
      {
        "id": "",
        "name": "wettransfer70.gsxx.org"
      },
      {
        "id": "",
        "name": "wettransfer70.dyxk.net"
      },
      {
        "id": "",
        "name": "wettransfer69.rrxk.org"
      },
      {
        "id": "",
        "name": "wettransfer69.nuxq.net"
      },
      {
        "id": "",
        "name": "wettransfer68.xtnw.org"
      },
      {
        "id": "",
        "name": "wettransfer68.teqg.net"
      },
      {
        "id": "",
        "name": "wettransfer67.tqfa.org"
      },
      {
        "id": "",
        "name": "wettransfer65.xirn.org"
      },
      {
        "id": "",
        "name": "wettransfer65.lxtf.org"
      },
      {
        "id": "",
        "name": "wettransfer64.zghf.org"
      },
      {
        "id": "",
        "name": "wettransfer64.wojq.net"
      },
      {
        "id": "",
        "name": "wettransfer64.teqg.net"
      },
      {
        "id": "",
        "name": "wettransfer64.qujh.org"
      },
      {
        "id": "",
        "name": "wettransfer64.nuxq.net"
      },
      {
        "id": "",
        "name": "wettransfer64.husf.org"
      },
      {
        "id": "",
        "name": "wettransfer63.xirn.org"
      },
      {
        "id": "",
        "name": "wettransfer63.gsxx.org"
      },
      {
        "id": "",
        "name": "wettransfer63.fvhz.org"
      },
      {
        "id": "",
        "name": "wettransfer62.lxtf.org"
      },
      {
        "id": "",
        "name": "wettransfer62.lowk.org"
      },
      {
        "id": "",
        "name": "wettransfer62.fdwn.org"
      },
      {
        "id": "",
        "name": "wettransfer61.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer61.lxtf.org"
      },
      {
        "id": "",
        "name": "wettransfer61.lowk.org"
      },
      {
        "id": "",
        "name": "wettransfer61.fdwn.org"
      },
      {
        "id": "",
        "name": "wettransfer60.zjvm.org"
      },
      {
        "id": "",
        "name": "wettransfer60.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer60.teqg.net"
      },
      {
        "id": "",
        "name": "wettransfer60.husf.org"
      },
      {
        "id": "",
        "name": "wettransfer60.dbft.org"
      },
      {
        "id": "",
        "name": "wettransfer59.zjvm.org"
      },
      {
        "id": "",
        "name": "wettransfer59.zghf.org"
      },
      {
        "id": "",
        "name": "wettransfer59.xirn.org"
      },
      {
        "id": "",
        "name": "wettransfer59.wojq.net"
      },
      {
        "id": "",
        "name": "wettransfer59.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer59.lxtf.org"
      },
      {
        "id": "",
        "name": "wettransfer59.husf.org"
      },
      {
        "id": "",
        "name": "wettransfer58.vaqi.org"
      },
      {
        "id": "",
        "name": "wettransfer58.jyse.org"
      },
      {
        "id": "",
        "name": "wettransfer58.dbft.org"
      },
      {
        "id": "",
        "name": "wettransfer58.ckfb.org"
      },
      {
        "id": "",
        "name": "wettransfer57.qaru.org"
      },
      {
        "id": "",
        "name": "wettransfer57.qujh.org"
      },
      {
        "id": "",
        "name": "wettransfer57.lxtf.org"
      },
      {
        "id": "",
        "name": "wettransfer57.gsxx.org"
      },
      {
        "id": "",
        "name": "wettransfer56.gsxx.org"
      },
      {
        "id": "",
        "name": "wettransfer56.lxtf.org"
      },
      {
        "id": "",
        "name": "wettransfer55.zwgr.org"
      },
      {
        "id": "",
        "name": "wettransfer55.zghf.org"
      },
      {
        "id": "",
        "name": "wettransfer55.vaqi.org"
      },
      {
        "id": "",
        "name": "wettransfer55.tynd.org"
      },
      {
        "id": "",
        "name": "wettransfer55.teqg.net"
      },
      {
        "id": "",
        "name": "wettransfer55.qezn.org"
      },
      {
        "id": "",
        "name": "wettransfer55.haqx.org"
      },
      {
        "id": "",
        "name": "wettransfer55.fvhz.org"
      },
      {
        "id": "",
        "name": "wettransfer54.vaqi.org"
      },
      {
        "id": "",
        "name": "wettransfer54.tynd.org"
      },
      {
        "id": "",
        "name": "wettransfer54.husf.org"
      },
      {
        "id": "",
        "name": "wettransfer54.fkfy.org"
      },
      {
        "id": "",
        "name": "wettransfer53.xirn.org"
      },
      {
        "id": "",
        "name": "wettransfer53.vaqi.org"
      },
      {
        "id": "",
        "name": "wettransfer53.tynd.org"
      },
      {
        "id": "",
        "name": "wettransfer53.qibx.org"
      },
      {
        "id": "",
        "name": "wettransfer53.fvhz.org"
      },
      {
        "id": "",
        "name": "wettransfer53.ckfb.org"
      },
      {
        "id": "",
        "name": "wettransfer52.tynd.org"
      },
      {
        "id": "",
        "name": "wettransfer52.rrxk.org"
      },
      {
        "id": "",
        "name": "wettransfer51.zghf.org"
      },
      {
        "id": "",
        "name": "wettransfer51.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer51.fvhz.org"
      },
      {
        "id": "",
        "name": "wettransfer51.fdwn.org"
      },
      {
        "id": "",
        "name": "wettransfer51.dyxk.net"
      },
      {
        "id": "",
        "name": "wettransfer50.xirn.org"
      },
      {
        "id": "",
        "name": "wettransfer50.wojq.net"
      },
      {
        "id": "",
        "name": "wettransfer50.vfwk.org"
      },
      {
        "id": "",
        "name": "wettransfer50.lxtf.org"
      },
      {
        "id": "",
        "name": "wettransfer50.dbft.org"
      },
      {
        "id": "",
        "name": "wettransfer49.zjvm.org"
      }
    ],
    "malware": [
      {
        "id": "0051da15-675b-4665-a6d1-872f64cf47ea",
        "name": "Lumma Stealer",
        "slug": "lumma-stealer"
      }
    ],
    "attack_patterns": [
      {
        "id": "5c67e5d2-bc85-4ce0-822d-f2f5d3b0ae4e",
        "name": "T1185"
      },
      {
        "id": "00430919-9257-403b-8a1b-958d4c3613aa",
        "name": "T1557"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      }
    ]
  },
  "external_refs": [
    "https://gist.githubusercontent.com/qbourgue/071c333ff5182f031da3ba55cc7da1ec/raw/ec4ba396c0d1052cc8b0a69c1bad1e0e5aef2ab6/malicious_domains_impersonating_reddit_wetransfer_selfau3_dropper_lumma_stealer_20012025.txt",
    "https://x.com/crep1x/status/1881404758843699402",
    "https://www.bleepingcomputer.com/news/security/hundreds-of-fake-reddit-sites-push-lumma-stealer-malware",
    "https://otx.alienvault.com/pulse/67934f1207a95b0217514e55"
  ]
}