Lumma Stealer – Tracking distribution channels
SecureList
APRIL 21, 2025
txt file contains aBase64-encoded PowerShell script that then downloads and runs theLumma Stealer. txt The script performs the following actions: Downloads the malware. It downloads the win15.zip When decoded, the malicious PowerShell script looks like this: Contents of win15.txt zip file from https[:]//win15.b-cdn[.]net/win15.zip
Let's personalize your content