Latrodectus Phishing Campaign Delivering LummaStealer via 302-Redirect Domain Infrastructure (lufyfeo[.]org, 36-domain cluster)
Latrodectus Phishing Campaign Delivering LummaStealer via (TL-2026-1483), also tracked as Latrodectus/LummaStealer 302-Redirect Cluster, is a high-severity malware campaign, first published 2026-07-18. It is attributed to TA578 - G1038 with medium confidence, affects Microsoft Windows (all supported desktop versions), maps to 41 MITRE ATT&CK techniques (T1005, T1016, T1021), and is covered by 9 detection rules and 45 indicators of compromise.
Key facts for TL-2026-1483
- Threat ID
- TL-2026-1483
- Also known as
- Latrodectus/LummaStealer 302-Redirect Cluster, lufyfeo.org Infrastructure Cluster
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-18
- Last reviewed
- 2026-07-18
- Attribution
- TA578 - G1038
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- all sectors opportunistic phishing, legal, professional services, finance, technology
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 45
Malware and tooling in Latrodectus Phishing Campaign Delivering LummaStealer via
Malware and tooling: IcedID, Latrodectus - S1160, Lumma Stealer - S1213, Latrodectus C2 (RC4/Base64), Validin
Passive DNS analysis (Validin) of the phishing domain lufyfeo[.]org, resolving to 193.106.174.218, uncovered a 36-domain cluster sharing hosting infrastructure and an identical HTTP 302-redirect pattern to legitimate PDF-hosting sites (documentcloud.org, harvardlawreview.org). The cluster is tied to the Latrodectus loader infection chain, which TA577/TA578 have used since late 2023 to ultimately deliver LummaStealer.
How Latrodectus Phishing Campaign Delivering LummaStealer via works
Embee Research analyzed passive DNS records via Validin for the phishing domain lufyfeo[.]org, which resolves to 193.106.174.218. By pivoting on shared IP infrastructure and a distinctive HTTP 302-redirect fingerprint that sends victims onward to legitimate document-hosting domains (documentcloud.org and, historically, harvardlawreview.org), analysts identified a cluster of 36 related malicious domains reusing the same hosting and redirect pattern. This redirect-to-legitimate-domain technique is a defense-evasion tactic: automated URL scanners and email security gateways see the final-hop destination as a trusted, high-reputation site, masking the malicious first hop.
The infrastructure is assessed to support the Latrodectus malware loader ecosystem. Latrodectus (MITRE ATT&CK Software S1160) is a Windows downloader first observed in September-November 2023 and assessed by Proofpoint and Unit 42 researchers as a likely successor to IcedID, built by the same developer group. It has been distributed primarily by TA577 (a historically prolific Qbot/IcedID distributor) and TA578 (assessed as an initial access broker using fraudulent contact-form submissions and copyright-infringement lures). Per Unit 42 reporting from March 7-8, 2024, the observed infection chain is: thread-hijacked email > malicious link > redirect to a fake Microsoft Azure page > Firebase-hosted URL > oversized JavaScript file download > victim double-click > wscript.exe executes the JS > JS generates WebDAV traffic to fetch an MSI package > msiexec.exe installs the Latrodectus DLL (exported function "fin") > Latrodectus establishes C2 over HTTP(S) > operators push a Lumma Stealer executable over the Latrodectus C2 channel for final-stage credential/data theft.
Latrodectus performs environment/anti-sandbox checks (minimum running-process count, 64-bit architecture verification, valid MAC address validation) before executing, uses a mutex ("runnung") to prevent re-infection, and persists via AutoRun registry keys and Windows Scheduled Tasks, self-copying to an AppData path derived from its bot ID. Its C2 protocol issues HTTP POST requests with RC4-encrypted (hardcoded key "12345"), Base64-encoded payloads, and uses FNV-1a hashing for campaign-ID values. Documented command handlers include arbitrary code execution (cmd_exec_exe/dll/cmd), system/process/desktop enumeration (cmd_get_sysinfo/proclist/desktop), self-update (cmd_update), and a legacy IcedID-component downloader (cmd_run_icedid, handler #18) retained from Latrodectus's shared IcedID lineage. Latrodectus has also been used to deliver QakBot, DarkGate, and PikaBot in other campaigns, in addition to Lumma Stealer.
Lumma Stealer (LummaC2) is a widely distributed, subscription-based information stealer written in C++/ASM, hardened with LLVM-based control-flow flattening/obfuscation, dead-code injection, and low-level syscall usage ("Heaven's Gate") to evade EDR hooking, and known to inject into legitimate processes (msbuild.exe, regasm.exe, regsvcs.exe, explorer.exe). It harvests browser-stored credentials, session cookies and autofill data from Chromium- and Gecko-based browsers, cryptocurrency wallet files/extensions (MetaMask, Electrum, Exodus), VPN configuration files, FTP and email client credentials, Telegram data, and documents (PDF/DOCX/RTF) from user profiles, then exfiltrates them over a tiered C2 architecture — hardcoded Tier-1 C2 domains fronted by Cloudflare, with Steam-profile and Telegram-channel fallback pointers and, in newer builds, blockchain-based (EtherHiding-style) C2 retrieval. Traffic to hardcoded C2s uses ChaCha20 encryption; fallback URL retrieval uses a custom stack-based cipher and ROT+11 obfuscation. Microsoft's Digital Crimes Unit conducted a large-scale takedown of roughly 2,300 Lumma-associated domains in May 2025, though the malware-as-a-service operation has continued to rebuild infrastructure since.
The reuse of a fixed 302-redirect fingerprint across 36 domains sharing a single hosting IP represents a durable pivot point: any newly registered domain resolving to 193.106.174.218 (or reusing the identical redirect-to-documentcloud.org/harvardlawreview.org pattern) should be treated as part of this cluster and blocked pending validation.
MITRE ATT&CK techniques used in TL-2026-1483
Collection
T1005 Data from Local System; T1115 Clipboard Data
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087.002 Domain Account; T1135 Network Share Discovery; T1482 Domain Trust Discovery; T1518.001 Security Software Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055.012 Process Hollowing; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.007 Msiexec; T1218.011 Rundll32; T1497 Virtualization/Sandbox Evasion; T1564.004 NTFS File Attributes; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1204.001 Malicious Link; T1569.002 Service Execution
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1104 Multi-Stage Channels; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1573.001 Symmetric Cryptography
Impact
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Initial Access
Affected products and versions in Latrodectus Phishing Campaign Delivering LummaStealer via
- Microsoft — Windows (all supported desktop versions)
Vulnerable versions: Windows 10; Windows 11; Windows Server (workstation-class endpoints)
Remediation for Latrodectus Phishing Campaign Delivering LummaStealer via
Immediate actions
- Block/sinkhole the resolved IP 193.106.174.218 and all 36 clustered phishing domains at DNS/firewall/proxy
- Alert on outbound HTTP 302 redirects sourced from newly-registered or low-reputation domains that terminate on documentcloud.org or harvardlawreview.org
- Block execution of JavaScript (.js) files launched directly via double-click / wscript.exe from user Downloads or email attachment paths
- Restrict or alert on msiexec.exe installing packages from WebDAV UNC paths (\\<ip>\<share>\*.msi or webdav://)
- Hunt for the mutex string "runnung" and AutoRun/Scheduled Task entries pointing to AppData-resident, randomly-bot-ID-named executables
- Search email gateway logs for TA578-style fraudulent contact-form submissions and copyright-infringement-themed lures, and TA577-style thread-hijacked emails with zipped JS/ISO attachments
Workarounds
- Disable the WebClient (WebDAV Client) service on workstations that do not require WebDAV connectivity
- Enforce Windows Script Host (WSH) restrictions or AppLocker policy to block .js execution outside of approved directories
Longer-term hardening
- Deploy network detection for RC4-encrypted, Base64-encoded HTTP POST beacons matching the documented Latrodectus C2 pattern
- Deploy EDR rules for process injection/hollowing into msbuild.exe, regasm.exe, regsvcs.exe, and explorer.exe (Lumma Stealer TTP)
- Establish continuous passive-DNS/Validin-style pivoting on any confirmed C2/redirect IP to proactively discover cluster expansion
- User awareness training on fake CAPTCHA ("ClickFix") pages and copyright-infringement/contact-form phishing lures
- Restrict WebDAV client access (WebClient service) on endpoints where not business-required
Timeline of Latrodectus Phishing Campaign Delivering LummaStealer via
- Latrodectus malware loader first observed in the wild, assessed as an emerging successor to the IcedID loader.
- TA577 begins distributing Latrodectus via thread-hijacked emails with zipped JavaScript/ISO attachments, before later reverting to Pikabot.
- TA578 becomes the primary Latrodectus operator, using fraudulent contact-form submissions impersonating companies with copyright-infringement claims.
- Unit 42 documents the full infection chain: thread-hijacked email > link > fake Azure page > Firebase URL > JS download > WebDAV MSI install > Latrodectus DLL > Lumma Stealer delivered over Latrodectus C2.
- Proofpoint, Trustwave, and Pulsedive publish in-depth Latrodectus technical analyses characterizing it as 'IcedID 2.0' with shared developer lineage.
- Broader industry reporting (The Hacker News, Infosecurity Magazine, Rewterz) confirms Latrodectus as an IcedID successor actively used in ongoing phishing campaigns.
- Microsoft's Digital Crimes Unit executes a large-scale takedown of approximately 2,300 domains supporting the Lumma Stealer malware-as-a-service operation.
- Embee Research publishes passive-DNS (Validin) analysis of lufyfeo[.]org (resolving to 193.106.174.218), identifying a 36-domain cluster sharing hosting and an identical HTTP 302-redirect pattern to documentcloud.org/harvardlawreview.org tied to the Latrodectus-to-LummaStealer delivery chain.
Sources cited for Latrodectus Phishing Campaign Delivering LummaStealer via
- Phishing Domain Analysis With Passive DNS (Latrodectus)
- Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns
- Latrodectus Malware Analysis: IcedID 2.0
- Analyzing Latrodectus: The New Face of Malware Loaders
- Pulsedive Threat Research - Latrodectus Loader
- New Malware "Latrodectus" Linked to IcedID
- Latrodectus, Software S1160 | MITRE ATT&CK
- Latrodectus Malware Loader Found in Phishing Campaigns, Replacing IcedID – Active IOCs
- Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer
- Lumma Stealer Malware Profile & 7d C2 Tracker
- LummaC2 stealer: Everything you need to know
- Lumma Stealer - Certego
- Lumma Stealer Malware Analysis, Overview by ANY.RUN
- New Updates to LummaC2 Stealer Malware
- Lumma Stealer Analysis
Threats related to Latrodectus Phishing Campaign Delivering LummaStealer via
- Latrodectus Loader: Three-Stage JScript/VBScript Obfuscation Delivers WMI/msiexec MSI Payload (sokingscrosshotel[.]com)
- Fake Google/Cloudflare Verification Pages Spread Multiple Malware Families via ClickFix (HijackLoader, StealC, Remus Stealer, Amatera Stealer, CastleLoader, NetSupport RAT, ResiLoader)
- ScreenConnect Masked as Freeware: Large-Scale AsyncRAT Distribution Campaign via SEO-Poisoned Fake Software Sites
- Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations
- Lampion Banking Trojan (ChePro Lineage) Multistage Phishing/Evasion Campaign Targets Portugal
- SnakeKeylogger Infostealer Delivered via Phishing Emails Disguised as Project Proposals (ASEC, JS→PowerShell Fileless Loader)
Detection coverage for TL-2026-1483
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1483 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.