# Lumma Stealer distributed via fake game updates on itch.io and Patreon (nexe-compiled Node.js loader)

> G DATA reports a campaign in which newly created itch.io accounts spam comments on legitimate games with templated 'update' messages linking to Patreon-hosted downloads of 'Updated Version.zip'. The archive holds a nexe-compiled Node.js executable (game.exe) that runs six anti-analysis checks and then reflectively loads a LummaStealer payload through a native .node module.

- **Published:** 2026-10-16T19:54:45Z
- **Last reviewed:** 2026-10-16T19:54:45Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3771
- **ID:** TL-2026-3771
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In a campaign documented by G DATA (Josemaria Grana, 2025-12-08), newly created itch.io accounts post templated comments across many legitimate indie games claiming to offer an 'official, safe, and fully working' game update with a changelog of bug fixes and stability improvements. The comments link to Patreon URLs that directly download an archive named 'Updated Version.zip'. G DATA characterizes this as a shotgun approach aimed at users unfamiliar with itch.io who may mistake the comments for genuine developer announcements.

Most files in the archive are benign; the exception is game.exe (78.21 MiB), a Node.js application converted to a PE binary with the nexe compiler. G DATA notes that earlier Node.js-based malware generally still needed a separate node.exe runtime, so a nexe-compiled loader appears to be a novel delivery technique. Its heavily minified and obfuscated JavaScript (mains.js, extracted with nexeDecompiler) runs six anti-analysis checks before doing anything malicious: (1) total memory under 4 GB or 2 or fewer CPU cores via os.totalmem()/os.cpus(); (2) the current username (NFC-normalized) against a list of 54+ sandbox-style names such as sandbox, vmware, malware, maltest, virus, wdagutilityaccount, johndoe; (3) 'tasklist /fo csv' output against 80+ analysis tools (IDA, x64dbg, OllyDbg, WinDbg, Frida, DynamoRIO, Pin, Wireshark, Burp Suite, Fiddler, Joe Sandbox and Cuckoo components); (4) 'wmic path win32_VideoController get name /value' for virtual adapters (Microsoft Basic Display Adapter, VMware SVGA 3D, VirtualBox Graphics Adapter, Hyper-V Video); (5) 'wmic path Win32_VideoController get CurrentRefreshRate /value', exiting when no valid rate is found or the maximum is below 29 Hz; (6) 'wmic diskdrive get model /value' for qemu, vbox, vmware, virtuozzo, virtio or 'dady hardiskk'.

If the checks pass, two Base64-encoded payloads are decoded. The first, modules.node, is a native Node-API DLL written to %temp% that exports napi_register_module_v1 and node_api_module_get_api_version_v1 and registers a function named 'PodstilkaBidena' via napi_create_function / napi_set_named_property. The second is the LummaStealer payload, which is passed through that function and reflectively loaded. G DATA assesses a single actor behind the many accounts: downloads from different URLs return different nexe-compiled JavaScript files with varying encodings, but all share the same count of anti-analysis routines and unique string identifiers in the decoded JavaScript. Later variants replace WMIC with PowerShell Get-CimInstance cmdlets to delay detection. G DATA says the actor keeps creating new accounts despite takedowns. The analysis disclosed no C2 infrastructure.

Lumma Stealer (LummaC2) is a subscription-based MaaS infostealer active since at least 2022. Per the joint FBI/CISA advisory AA25-141B it targets browser data (credentials, cookies, extensions), cryptocurrency wallets and 2FA information, and exfiltrates over HTTP POST to C2 servers, with fallback to public services such as Telegram, Dropbox and Steam. In May 2025 the DOJ, Microsoft and partners seized five core LummaC2 domains and over 2,300 related domains, but the operation persists. No CVE, CVSS score or named actor is stated in the sources; severity is an analyst assessment.

## MITRE ATT&CK

- T1585.001 Social Media Accounts
- T1608 Stage Capabilities
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1047 Windows Management Instrumentation
- T1059.001 PowerShell
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1620 Reflective Code Loading
- T1057 Process Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1518.001 Security Software Discovery
- T1555.003 Credentials from Web Browsers
- T1005 Data from Local System

## Sources

- [Lumma Stealer: Danger lurking in fake game updates from itch.io and Patreon (G DATA)](https://blog.gdatasoftware.com/2025/12/38310-lumma-stealer-itchio-patreon)
- [CISA/FBI Advisory AA25-141B: LummaC2 Malware Targeting U.S. Critical Infrastructure Sectors](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b)
- [FBI IC3 PSA/CSA 250521-2: LummaC2 advisory (PDF)](https://www.ic3.gov/CSA/2025/250521-2.pdf)
- [AttackIQ: Response to CISA Advisory AA25-141B](https://www.attackiq.com/2025/05/22/response-to-cisa-advisory-aa25-141b/)
- [SOCRadar: Disrupting Lumma Stealer - Microsoft Leads Global Action](https://socradar.io/blog/disrupting-lumma-stealer-malware-microsoft-leads-global-action/)
- [Security Affairs: Law enforcement dismantled the infrastructure behind Lumma Stealer MaaS](https://securityaffairs.com/?p=178176)
- [SecurityOnline: itch.io targeted - Lumma Stealer deployed via fake updates and reflective Node.js loader](https://securityonline.info/itch-io-targeted-lumma-stealer-deployed-via-fake-updates-and-reflective-node-js-loader/)
- [Cyberpress: Lumma Stealer malware](https://cyberpress.org/lumma-stealer-malware/?amp=1)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3771