Beware of fake CrowdStrike domains pumping out Lumma infostealing malware

CrowdStrike is the latest lure being used to trick Windows users into downloading and running the notorious Lumma infostealing malware, according to the security shop's threat intel team, which spotted the scam just days after the Falcon sensor update fiasco. Infostealers such as Lumma scour infected machines for any stored …

[Yorick Hunt]

My first response would be "well derr, nobody's going to fall for this!" - but then the realisation hits that beside actual IT professionals, there'll be countless middle and upper management types who have admin access (at least to their computers if not to the domain), who appear to be genetically pre-dispositioned to clicking on obviously malicious links.

[Pascal Monett]

Yeah but, if the malware auto-shuts-down if it detects AV software running, shouldn't that mean that every business PC and every Windows 1 0 + should be protected, even if it's just by Windows Defender ?

[Yorick Hunt]

In theory, perhaps - but is that behaviour absolutely assured? What other manner of droppers are left there to wait patiently for a suitable opportunity?