Microsoft Leads Global Action To Disable Lumma Stealer Malware

The spread of malware infection. (Microsoft)

JAKARTA - Microsoft's Digital Crime Unit (Digital Crimes Unit/CCU) and its international partners managed to lead global operations to thwart information theft malware known as Lumma Stealer.

This malware has for years been the mainstay of hundreds of cybercriminals in stealing passwords, credit cards, bank accounts, and cryptocurrency wallets to ask for ransom from victims.

This action came after Microsoft filed a lawsuit at the United States District Court for Georgia's Northern District on May 13.

Through the court's decision, Microsoft managed to confiscate and block around 2,300 dangerous domains that became the main infrastructure for the distribution of Lumma.

At the same time, the US Department of Justice (DOJ) also confiscated the central command structure for Lumma and disrupted the market where the tool was sold to other cybercriminals.

During the period between March 16, 2025, and May 16, 2025, Microsoft managed to identify more than 394,000 Windows computers worldwide infected by Luma malware.

"In collaboration with law enforcement and industrial partners, we have cut communication between these dangerous tools and victims," said Assistant Legal Advisor, Microsoft Digital Crime Unit Steven Masada in a statement on its official website.

The operation was carried out with global law enforcement agencies including Europol, JC3 Japan, as well as cybersecurity companies such as ESET, BitSight, Lumen, Cloudflare, and CleanDNS.

This joint action was designed to slow down the speed of these perpetrators in launching their attacks, minimizing the effectiveness of their campaigns, and blocking their illicit gains.

The main Lumma developer who goes by the pseudonym 'Shamel' is known to be based in Russia and has about 400 active customers.

He marketed Lumma in various service packages via Telegram, ranging from packages worth 250 to 20,000 US dollars (IDR 4 million to IDR 3.2 billion) which includes full access to the source code.

Microsoft insists that cross-border and sector collaboration is critical to hampering the rate of cybercrime.