Microsoft’s Digital Crimes Unit (DCU) and global partners have halted Lumma Stealer, one of cybercriminals’ most common info-stealing malware tools. On May 13, Microsoft and law enforcement agencies seized nearly 2,300 domains that comprise Lumma’s infrastructure, inflicting a significant blow to cybercrime networks targeting sensitive private and institutional data.
Lumma is a Malware-as-a-Service (MaaS) that has been advertised on underground forums since 2022. It specialises in siphoning passwords, banking credentials, cryptocurrency wallets, and other information. Its victims include individual consumers, schools, banks, and critical service providers. Between March and May 2025, Microsoft found about 394,000 Lumma-infected Windows systems. The majority of these systems were located in Brazil, the United States, and other parts of Europe.
The operation, which was permitted by the US District Court for the Northern District of Georgia, involved Microsoft, the US Department of Justice, Europol, and Japan’s Cybercrime Control Centre. The DOJ removed Lumma’s command infrastructure, while law enforcement assisted in the suspension of local networks that supported the malware.