Back Securityaffairs.Co

LummaStealer activity spikes post

Securityaffairs.Co •Pierluigi Paganini • February 12, 2026

Bitdefender reports a surge in LummaStealer activity, showing the MaaS infostealer rebounded after 2025 law enforcement disruption. Bitdefender observed renewed LummaStealer activity, proving the MaaS infostealer recovered after 2025 takedowns. Active since 2022, it relies on affiliates, social engineering, fake cracked software, and fake CAPTCHA “ClickFix” lures. CastleLoader plays a key role in spreading it. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LummaStealer Infections Rise Following CastleLoader Campaigns LummaStealer infections have surged due to social engineering campaigns utilizing the ClickFix technique to distribute CastleLoader malware. This infostealer, operating as a malware-as-a-service platform, had previously been disrupted in May 2025 when law enforcement seized 2,300 domains associated with it. 7 sources 41

LummaStealer activity spikes post

The full story

Extracted Entities

Attack Types (1)

Malware (2)