LummaStealer Resurges With CastleLoader and ClickFix Delivery Campaigns
Summary
Bitdefender researchers detail LummaStealer’s resurgence after a 2025 law-enforcement disruption, tracing campaigns that use CastleLoader, social-engineering lures and fake CAPTCHA pages to steal credentials, sessions and other sensitive data.
Key points
- LummaStealer rebuilt its infrastructure after a May 2025 disruption that neutralized more than 2,300 command-and-control domains.
- Campaigns primarily rely on social engineering, including fake cracked software, game and media downloads, and deceptive content shared through legitimate platforms.
- ClickFix pages trick users into pasting and running attacker-provided commands, which can download CastleLoader and then LummaStealer.
- CastleLoader runs in stages, uses obfuscation and in-memory execution, checks for sandbox environments, and can establish persistence through startup shortcuts or scheduled tasks.
- Researchers identified a CastleLoader artifact: DNS lookups for nonexistent domains formed by repeating the same random string on either side of a dot.
- LummaStealer can steal browser credentials and sessions, documents, financial and cryptocurrency data, 2FA information, and data from applications such as Discord and Steam.
- Recommended defenses include avoiding untrusted downloads and manual command instructions, monitoring suspicious process chains and DNS activity, and rotating passwords and invalidating sessions after suspected infection.
Article Details
- Attack Vectors
- Fake cracked-software, game, and media downloads deliver CastleLoader, often in self-extracting archives or NSIS installers; execution depends on the victim running the file.
- ClickFix pages use fake CAPTCHA or verification prompts to persuade victims to paste and execute a PowerShell command that retrieves a loader.
- Some campaigns use obfuscated VBA or JavaScript scripts and scheduled tasks before launching the AutoIt-based loader.
- CastleLoader checks for sandbox and virtualization processes, establishes persistence through files and shortcuts in the Startup directory, and decrypts and executes payloads in memory.
- LummaStealer collects credentials, cookies, documents, cryptocurrency data, and other sensitive information, then uploads data to a configured C2 server.
- Defensive Notes
- Avoid downloading software, games, or media from untrusted or unofficial sources, especially content advertised as cracked, free, or exclusive.
- Treat websites that instruct users to manually execute PowerShell or command-line commands as malicious.
- Educate users about social-engineering lures; monitor for anomalous authentication behavior, suspicious process chains, living-off-the-land binary abuse, and anomalous DNS activity.
- After suspected infection, rotate passwords, invalidate active sessions where possible, prioritize email and financial accounts, and consider reinstalling the operating system.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sfcphdahojohzebbxpmiubtaoh[.]sfcphdahojohzebbxpmiubtaoh | Example of the nonexistent, repeated-string domain CastleLoader pings to generate a detectable failed DNS lookup. |
| URL | hxxp[:]//45[.]221[.]64[.]224/12[.]d | PowerShell command URL used to retrieve and execute a next-stage script from attacker infrastructure. |
MITRE ATT&CK
T1005 · Data from Local SystemLummaStealer collects sensitive local files and data, including documents, credentials, and cryptocurrency information.T1027 · Obfuscated Files or InformationCastleLoader scripts and VBA are obfuscated; some delivery chains concatenate file fragments to evade static detection.T1036.007 · Double File ExtensionA purported movie file uses a double extension, such as .mp4.exe, to appear to be media.T1041 · Exfiltration Over C2 ChannelLummaStealer uploads collected sensitive data to the C2 server specified in its configuration.T1053.005 · Scheduled TaskA script creates a scheduled task that runs periodically to maintain persistence.T1059.001 · PowerShellClickFix lures instruct victims to run a PowerShell one-liner that downloads and executes a script.T1059.003 · Windows Command ShellCampaign scripts use cmd.exe to execute batch files and launch extracted components.T1059.005 · Visual BasicSome campaigns run obfuscated VBA scripts before launching the AutoIt loader.T1059.007 · JavaScriptA campaign script is launched with wscript.exe from a .js file.T1105 · Ingress Tool TransferClickFix PowerShell commands and some loader stages retrieve next-stage payloads from attacker infrastructure.T1113 · Screen CaptureThe analyzed CastleLoader-delivered sample can capture screenshots.T1115 · Clipboard DataThe analyzed CastleLoader-delivered sample can collect clipboard data.T1140 · Deobfuscate/Decode Files or InformationCastleLoader decodes strings and decrypts payload layers before decompressing the resulting executable.T1204.002 · Malicious FileVictims are lured into downloading and running fake software, game, or media executables.T1204.004 · Malicious Copy and PasteClickFix prompts victims to paste clipboard contents and press Enter, manually executing the attacker-provided command.T1497.001 · System ChecksCastleLoader checks computer names, usernames, and virtualization or sandbox processes before continuing.T1539 · Steal Web Session CookieLummaStealer collects browser cookies and active sessions.T1547.001 · Registry Run Keys / Startup FolderCastleLoader creates a shortcut in the user's Startup directory to run the loader at startup.T1555.003 · Credentials from Web BrowsersLummaStealer collects credentials stored in web browsers.T1555.005 · Password ManagersLummaStealer collects information from password managers, including KeePass.
People
Threat Actors
Malware
CastleLoaderLummaStealer Is Getting a Second Life Alongside CastleLoaderDonutLoaderdevelopment websites. The loaders themselves change frequently; we've seen LummaStealer using Rugmi, DonutLoader, and, more recently, CastleLoader for initial execution.LummaStealerLummaStealer Is Getting a Second Life Alongside CastleLoaderRugmiand game development websites. The loaders themselves change frequently; we've seen LummaStealer using Rugmi, DonutLoader, and, more recently, CastleLoader for initial execution.
Products
AutoItCastleLoader is a script-based loader that aims to decrypt and load a payload into memory. Variants are implemented in Python, but we discovered one implemented in AutoIt in this campaign.Discordtheft of Discord and Steam dataMicrosoft Windowsforums in late 2022, and evolved into one of the most prolific infostealers by the mid-2020s. It targets Windows systems and can harvest a wide range of sensitive data, including browser credentials, session cookies,PowerShell+ R, paste the contents of the clipboard, and press Enter. The malicious website has already placed a PowerShell one-liner on the clipboard, which, when executed, retrieves and runs the next-stage loader directlySteamevolving social-engineering lures, ranging from fake CAPTCHA challenges to bogus update notifications on Steam pages and game development websites. The loaders themselves change frequently; we've seen LummaStealer
Countries
IndiaLumma stealer is still prevalent globally, with active infections observed mostly in India but also in the US and Europe. The investigation covered a period of one month, between December 12 and January 12.United StatesThis behavior triggers a DNS lookup for a nonexistent domain. The resulting anomalous request is easy to identify using this pattern, which allowed us to uncover hundreds of samples linked to the current campaign.