Threat reportMalwareTL-2026-3771
Lumma Stealer distributed via fake game updates on itch.io and Patreon (nexe-compiled Node.js loader)
Lumma Stealer distributed via fake game updates on itch.io (TL-2026-3771), also tracked as LummaC2 itch.io Patreon fake update campaign, is a high-severity malware campaign, first published 2026-10-16. It has no confirmed attribution, affects Microsoft Windows, maps to 17 MITRE ATT&CK techniques (T1005, T1027, T1033), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-3771
- Threat ID
- TL-2026-3771
- Also known as
- LummaC2 itch.io Patreon fake update campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- gaming, consumer, cryptocurrency
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Lumma Stealer distributed via fake game updates on itch.io
Malware and tooling: Lumma Stealer - S1213, Tasklist - S0057, nexe
How Lumma Stealer distributed via fake game updates on itch.io works
G DATA reports a campaign in which newly created itch.io accounts spam comments on legitimate games with templated 'update' messages linking to Patreon-hosted downloads of 'Updated Version.zip'. The archive holds a nexe-compiled Node.js executable (game.exe) that runs six anti-analysis checks and then reflectively loads a LummaStealer payload through a native .node module.
In a campaign documented by G DATA (Josemaria Grana, 2025-12-08), newly created itch.io accounts post templated comments across many legitimate indie games claiming to offer an 'official, safe, and fully working' game update with a changelog of bug fixes and stability improvements. The comments link to Patreon URLs that directly download an archive named 'Updated Version.zip'. G DATA characterizes this as a shotgun approach aimed at users unfamiliar with itch.io who may mistake the comments for genuine developer announcements.
Most files in the archive are benign; the exception is game.exe (78.21 MiB), a Node.js application converted to a PE binary with the nexe compiler. G DATA notes that earlier Node.js-based malware generally still needed a separate node.exe runtime, so a nexe-compiled loader appears to be a novel delivery technique. Its heavily minified and obfuscated JavaScript (mains.js, extracted with nexeDecompiler) runs six anti-analysis checks before doing anything malicious: (1) total memory under 4 GB or 2 or fewer CPU cores via os.totalmem()/os.cpus(); (2) the current username (NFC-normalized) against a list of 54+ sandbox-style names such as sandbox, vmware, malware, maltest, virus, wdagutilityaccount, johndoe; (3) 'tasklist /fo csv' output against 80+ analysis tools (IDA, x64dbg, OllyDbg, WinDbg, Frida, DynamoRIO, Pin, Wireshark, Burp Suite, Fiddler, Joe Sandbox and Cuckoo components); (4) 'wmic path win32_VideoController get name /value' for virtual adapters (Microsoft Basic Display Adapter, VMware SVGA 3D, VirtualBox Graphics Adapter, Hyper-V Video); (5) 'wmic path Win32_VideoController get CurrentRefreshRate /value', exiting when no valid rate is found or the maximum is below 29 Hz; (6) 'wmic diskdrive get model /value' for qemu, vbox, vmware, virtuozzo, virtio or 'dady hardiskk'.
If the checks pass, two Base64-encoded payloads are decoded. The first, modules.node, is a native Node-API DLL written to %temp% that exports napi_register_module_v1 and node_api_module_get_api_version_v1 and registers a function named 'PodstilkaBidena' via napi_create_function / napi_set_named_property. The second is the LummaStealer payload, which is passed through that function and reflectively loaded. G DATA assesses a single actor behind the many accounts: downloads from different URLs return different nexe-compiled JavaScript files with varying encodings, but all share the same count of anti-analysis routines and unique string identifiers in the decoded JavaScript. Later variants replace WMIC with PowerShell Get-CimInstance cmdlets to delay detection. G DATA says the actor keeps creating new accounts despite takedowns. The analysis disclosed no C2 infrastructure.
Lumma Stealer (LummaC2) is a subscription-based MaaS infostealer active since at least 2022. Per the joint FBI/CISA advisory AA25-141B it targets browser data (credentials, cookies, extensions), cryptocurrency wallets and 2FA information, and exfiltrates over HTTP POST to C2 servers, with fallback to public services such as Telegram, Dropbox and Steam. In May 2025 the DOJ, Microsoft and partners seized five core LummaC2 domains and over 2,300 related domains, but the operation persists. No CVE, CVSS score or named actor is stated in the sources; severity is an analyst assessment.
MITRE ATT&CK techniques used in TL-2026-3771
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1620 Reflective Code Loading
Discovery
T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1518.001 Security Software Discovery
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File
Credential Access
T1555.003 Credentials from Web Browsers
Resource Development
Affected products and versions in Lumma Stealer distributed via fake game updates on itch.io
- Microsoft — Windows
Vulnerable versions: Windows systems where users run the downloaded game.exe - itch.io — itch.io comment sections (abuse of platform)
Vulnerable versions: N/A - platform abuse - Patreon — Patreon file hosting (abuse of platform)
Vulnerable versions: N/A - platform abuse
Remediation for Lumma Stealer distributed via fake game updates on itch.io
Immediate actions
- Block or alert on execution of game.exe/node-based PE binaries launched from user-downloaded 'Updated Version.zip' archives
- Hunt for modules.node written to %TEMP% and for the listed SHA256 hashes
- Reset passwords, revoke browser sessions/cookies and rotate crypto-wallet and 2FA secrets for any user who ran the archive
- Report malicious itch.io accounts and Patreon pages to the respective platforms
Workarounds
- Alert on rapid sequences of tasklist /fo csv and wmic Win32_VideoController/diskdrive queries from a single unsigned process
- Use vendor signatures: Win64.Trojan.Agent.Y6OBDP (modules.node), Win64.Trojan-Stealer.LummaStealer.V34XV4 (payload)
Longer-term hardening
- Train users that game updates are delivered only via the developer's official page or launcher, not via comment links
- Deploy EDR with behavioral detection for infostealers and reflective loading
- Restrict browser credential storage and enforce phishing-resistant MFA
Timeline of Lumma Stealer distributed via fake game updates on itch.io
- Lumma Stealer (LummaC2) MaaS active since at least 2022 per CISA/FBI AA25-141B (exact start day not stated)
- Start of the period of LummaC2 infections whose IOCs are listed in CISA/FBI advisory AA25-141B (November 2023 - May 2025)
- DOJ, Microsoft and international partners seize five core LummaC2 domains and over 2,300 related domains; Microsoft sinkholes more than 1,300
- CISA and FBI publish advisory AA25-141B on LummaC2 TTPs and IOCs
- G DATA reports new itch.io accounts are still being created and spamming games despite takedowns; later samples swap WMIC for PowerShell Get-CimInstance
- G DATA publishes analysis of the itch.io/Patreon fake game update campaign delivering LummaStealer via a nexe-compiled Node.js loader
Sources cited for Lumma Stealer distributed via fake game updates on itch.io
- Lumma Stealer: Danger lurking in fake game updates from itch.io and Patreon (G DATA)
- CISA/FBI Advisory AA25-141B: LummaC2 Malware Targeting U.S. Critical Infrastructure Sectors
- FBI IC3 PSA/CSA 250521-2: LummaC2 advisory (PDF)
- AttackIQ: Response to CISA Advisory AA25-141B
- SOCRadar: Disrupting Lumma Stealer - Microsoft Leads Global Action
- Security Affairs: Law enforcement dismantled the infrastructure behind Lumma Stealer MaaS
- SecurityOnline: itch.io targeted - Lumma Stealer deployed via fake updates and reflective Node.js loader
- Cyberpress: Lumma Stealer malware
Detection coverage for TL-2026-3771
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3771 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.