Lumma Stealer Resurges with Advanced Browser Fingerprinting Tactics for C&C Evasion

Cybersecurity experts at Trend Micro have confirmed a comeback in Lumma Stealer activity following a brief disturbance in the threat actor's infrastructure earlier this year. The well-known information-stealing malware, tracked internally by Trend Micro as "Water Kurita," has returned with a substantial operational change: cutting-edge browser fingerprinting capabilities included in its command-and-control infrastructure.

Revival of a hazardous infostealer

The activity of the malware dramatically decreased after the claimed core members of the Lumma Stealer scheme were revealed via a focused doxxing campaign in September 2025. Beginning the week of October 20, 2025, however, Trend Vision One telemetry data identified a significant rise in Lumma Stealer targeting, hence indicating the return of the threat actors with improved operational capabilities.

The comeback represents a turning point in the underground cybercrime scenario. Many clients switched to other malware-as-a-service providers like Vidar and StealC during the downtime. Still, Lumma's operators have bolstered their systems with fresh techniques meant to avoid discovery and better target prospective victims.

Browser Fingerprinting: A New Evasion Layer

The most noteworthy enhancement of Lumma Stealer's toolset is the application of browser fingerprinting technique. This fingerprinting method does not just rely on collecting basic information via one active channel, but also involves gathering extensive information at system, network, and browser levels through JavaScript payloads running in the affected browsers.

When the infected user visits the special C&C address /api/set_agent, the malware sends out an HTTP GET request with multiple parameters: a unique 32-character device id, a session authentication token, and browser identification data. The C&C server then sends back a JavaScript fingerprinting script that goes about collecting in a systematic way a large number of details about the victim's environment.

Data collected includes such things as platform specifics, user agent strings, language settings, number of CPU cores, amount of device RAM, graphics card supplier information, and WebGL renderer information. Moreover, the malware performs WebRTC analysis to obtain network interface details and eavesdrops on audio system capabilities by performing audio context analysis. The malware, after having built a complete profile, converts the data to JSON format, sends it out via an HTTP POST request, and then redirects the browser to about:blank to keep the user unaware of the operation.

Maintaining Operational Redundancy

Lumma Stealer's actions are aimed at maintaining a layered communication system rather than replacing it with the new fingerprinting method. The malware keeps its communication open by combining traditional methods with new ones. The usual WinHTTP-based C&C process continues to function along with the fingerprinting endpoint. This guarantees that the operators will still be able to monitor and evaluate the environments of the victims before the deployment of secondary payloads, thus being able to take advantage of the new infrastructure.​

In accordance with Trend Micro's observation, "This uniformity shows that the fingerprinting feature is an addition to the C&C infrastructure and not a replacement, it implies that the users are building new capabilities over the old ones."

Strategic Implications for Defenders

The fingerprinting mechanism provides the threat actors with various tactical advantages. The very detailed information about the infected systems operates can point out virtual machines and sandboxes thereby recognizing the analysis environments and cutting down the exposure to security researchers. This improved ability to escape detection has a huge impact on the malware's survival rate on user systems.

Moreover, the thorough victim profiling enables the operators to choose the victims based on their needs and hence, they can deploy payloads according to system capabilities and victim profiles. This is a very sophisticated threat for organizations as Lumma Stealer is a very advanced one compared to its predecessors.

Technical Delivery Methods Unchanged

The changes made to the C&C infrastructure have been significant but the delivery methods of Lumma Stealer reflect a very similar pattern to the past campaigns. The method for spreading the malware is still the same; it is through phishing emails, ads that are malicious, downloading of cracked software, and fake CAPTCHA verification pages that are designed to deceive users into running the malwares' payloads. The use of process injection techniques is one of the ways that the malware can execute in trusted applications; in particular, remote thread injection from MicrosoftEdgeUpdate.exe (a legitimate system process) into Chrome browser processes is one of the authorities that they use to bypass a large number of the endpoint security controls.

Information Theft Capabilities Remain Comprehensive

Lumma Stealer still has its huge information-gathering ability after installation. The malicious software gets saved passwords, autofill data, browsing history, and session cookies from Chrome, Firefox, Edge, and Brave browsers. Cryptocurrency wallets such as Binance, Electrum, Ethereum, and MetaMask, in turn, are the main targets of the malware along with email clients and other sensitive apps.​

The hackers get the information melted down to make it less visible then and sent to the attackers' remote servers where it gets sorted and eventually sold in the dark web markets or used directly for financial fraud and identity theft.

Operational Degradation Signals a Weakened Position

Even though there has been a revival, the evidence points to a decline in the operational security of the threat actors. The latest Lumma samples have already included command-and-control domains that are no longer in use, which have been sinkholed by Microsoft and security researchers. Previous versions used multiple C&C servers to rotate domains very skillfully, but nowadays the samples mostly point to one active C&C domain along with non-functional infrastructure. ​ 

This post at the same time deterioration of operational security indicates that the Lumma Stealer is still a very active threat, but the doxxing campaign really helped the threat actors to un- determine their infra structure management capabilities.

Recommendations for Organizations and Users

In view of the risks related to malware, security specialists recommend that companies limit user permissions, create and maintain approved software repositories, and thus enforce software installation controls. Moreover, it might be safer to keep certain situations with CAPTCHA requests that require the user to copy-paste commands or to run PowerShell scripts - legitimate CAPTCHA pages normally need only image verification.

Organizations should consider deploying endpoint security solutions in order to preemptively force Lumma Stealer out of their systems and at the same time have their employees trained on how to detect phishing and safe browsing. One of the most effective security practices would be to regularly update software as this would eliminate the risk of malware taking advantage of unpatched security flaws.