Infostealers in Banking Fraud: Stolen Credentials and Session Cookies Enable Silent Intrusions (Lumma, RisePro, METAStealer, Phantom Stealer)

Key facts for Lumma RisePro session theft

Detection coverage for Lumma RisePro session theft

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5386 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Lumma ClickFix - mshta Remote Script Execution or PowerShell Child of mshta

TL-2026-5386: detects the Lumma Stealer ClickFix/fake-CAPTCHA execution chain in which mshta.exe fetches JavaScript from an attacker host (http/https/javascript: argument) and then launches PowerShell for follow-on scripts, ahead of process hollowing and credential harvesting. mshta with a remote URL is rare in normal enterprise operation, so this is a behaviour-first, high-fidelity early signal.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1218.005, T1204.004, T1059.001
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ((Image="*\\mshta.exe" (CommandLine="*http://*" OR CommandLine="*https://*" OR CommandLine="*javascript:*")) OR (ParentImage="*\\mshta.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe"))) | eval chain=if(match(Image,"(?i)mshta\\.exe$"),"mshta_remote_content","mshta_spawns_powershell") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host User chain | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ 'mshta.exe' and ProcessCommandLine matches regex @'(?i)(https?://|javascript:)')
    or (InitiatingProcessFileName =~ 'mshta.exe' and FileName in~ ('powershell.exe', 'pwsh.exe'))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName

Sigma

title: Lumma ClickFix mshta Remote Script and PowerShell Child
id: 3f1c7a52-8d4e-4b6a-9c21-5e7a0b9d1f43
status: experimental
description: Detects mshta.exe loading remote content or spawning PowerShell, the ClickFix execution chain used to deliver Lumma Stealer (TL-2026-5386).
references:
  - https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/
  - https://www.group-ib.com/blog/infostealers-banking-fraud-stolen-credentials/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_mshta_remote:
    Image|endswith: '\mshta.exe'
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'javascript:'
  selection_mshta_child:
    ParentImage|endswith: '\mshta.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: 1 of selection_*
falsepositives:
  - Legacy HTA-based line-of-business applications launched from a URL
  - Software deployment scripts that invoke mshta
level: high

Known false positives:

• Legacy HTA-based line-of-business applications launched from an internal URL
• Software deployment or inventory scripts that call mshta.exe

Tuning notes: Allowlist known internal HTA application hosts by URL or hash. Adjust the index name to your Sysmon index. Where Sysmon is not deployed, use Security 4688 with command-line auditing enabled. Escalate to high priority when the parent of mshta.exe is explorer.exe (Run dialog).

• 🔒 Phantom Stealer Phishing - Archive Attachment from Campaign Infrastructure or Spoofed Procurement Lure · unlock with TL Creds
• 🔒 Stolen Session Cookie Replay - Same Entra Session from Multiple IPs and Countries · unlock with TL Creds
• 🔒 Infostealer C2 and Exfiltration - Campaign and Community Domains, Telegram/Discord/Steam from Non-Browser Process · unlock with TL Creds
• 🔒 Phantom Stealer JavaScript Dropper Executed from Archive Extraction or Temp Path · unlock with TL Creds
• 🔒 ClickFix Run Dialog PowerShell Download Cradle or CAPTCHA Lure Command · unlock with TL Creds
• 🔒 DNS Lookup of Lumma, Phantom Stealer and Community-Observed ClickFix Domains · unlock with TL Creds
• 🔒 Infostealer Browser Credential and Cookie Store Staged by Non-Browser Process · unlock with TL Creds
• 🔒 Lumma Process Hollowing Hosts - msbuild/regasm/regsvcs Outbound Connection · unlock with TL Creds

Indicators of compromise for Lumma RisePro session theft

As of 2026-11-06, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5386.

Sample indicators (3 of 16)

• IP address: 108.171.108[.]248
• Domain: scxzswx[.]lovestoblog[.]com
• IP address: 216.131.75[.]250

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

How Lumma RisePro session theft works

Group-IB (published 2026-11-06) describes a commercialized fraud-as-a-service ecosystem in which stealer-as-a-service subscriptions (Lumma, RisePro, METAStealer, Phantom Stealer), phishing kits, pre-harvested credential logs, seasoned mule accounts and cash-out services are each rented separately. The malware copies saved passwords, session cookies, autofill data and corporate SSO tokens from browsers. Victims typically notice nothing and no perimeter alert fires. In the typical sequence a customer downloads an apparently legitimate tool (a free PDF converter or a fake search result), the stealer executes, harvests and self-deletes, and six or more weeks can pass before the stolen data is used for an unauthorized login, a social-engineered MFA bypass or a fund transfer.

Session cookies are post-authentication tokens, so replaying them gives access to an already-trusted session without re-authenticating. Where a fresh login is needed, attackers phone victims while impersonating the bank to obtain one-time codes. A single log feeds four crimes: account takeover, mule account onboarding, session hijacking and ransomware support, and corporate access via SSO tokens. Pre-seasoned mule accounts at multiple banks pass KYC checks before showing suspicious behaviour. Group-IB notes that the most valuable corporate access (domain admin, VPN panels, SaaS logins) has moved into private channels, with public corporate access listings down 27%.

Operation Secure, an INTERPOL-coordinated action from January to April 2025, targeted infostealer infrastructure. It involved law enforcement in more than 25 countries and addressed nearly 70 malware variants. Results: 20,000+ malicious IPs and domains taken down, 41 servers seized, 100+ GB of data recovered, 32 arrests (18 in Vietnam, 14 in Sri Lanka and Nauru) and 216,000+ victims notified. Hong Kong police found 117 C2 servers across about 89 ISPs. Group-IB contributed intelligence on Lumma, RisePro and METAStealer.

Lumma technical detail (Microsoft, 2025-05-21): delivery by ClickFix/fake CAPTCHA, malvertising, phishing, drive-by JavaScript, cracked software, GitHub-hosted lures and secondary delivery by loaders such as DanaBot. The execution chain is mshta then PowerShell then the Lumma executable, with process hollowing into msbuild.exe, regasm.exe, regsvcs.exe or explorer.exe. C2 traffic is HTTPS behind Cloudflare, with fallback C2s resolved via Steam profiles and Telegram channels, and the C2 protocol version is 4.0. It targets Chromium and Gecko browser data, crypto wallets and extensions, VPN (.ovpn) files, email, FTP and Telegram clients, and documents. Microsoft DCU and partners took down about 2,300 Lumma domains on 2025-05-21 and attributed the service to Storm-2477, with affiliates including Octo Tempest, Storm-1607, Storm-1113 and Storm-1674.

Phantom Stealer (Group-IB, tracked November 2025 to January 2026): a .NET stealer sold in the 'Phantom Project' bundle (stealer, crypter, RAT). Five phishing waves hit logistics, manufacturing and technology organizations in Europe. The emails impersonated an equipment trader with procurement/request-for-quote subjects, and carried .tar/.7z/.zip/.rar archives containing obfuscated JavaScript droppers or executables. It harvests browser passwords, cookies, autofill and payment cards, Discord/Telegram/Outlook session data and Wi-Fi credentials, and exfiltrates via Telegram, Discord, SMTP or FTP. Emails failed SPF and lacked DKIM.

The article names no specific threat actors; activity is attributed to service users renting tools. Severity is analyst-assessed (no CVE or CVSS). The article lists no IOCs of its own, so the IOCs here come from the cited Group-IB Phantom Stealer report and Microsoft's Lumma analysis. Group-IB recommends cyber-fraud fusion workflows, upstream detection weeks before transactions, tracking criminal payment details and money flows, flagging newly onboarded mule accounts, and monitoring underground markets for harvested logs.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta; T1497 Virtualization/Sandbox Evasion

Execution

T1059.001 PowerShell; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste

Credential Access

T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

lateral-movement

T1550.004 Web Session Cookie

Initial Access

T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583.001 Domains

Impact

T1657 Financial Theft

Remediation for Lumma RisePro session theft

Immediate actions

• Invalidate and reissue session tokens, cookies and SSO sessions for any user or device with confirmed infostealer exposure, then force password resets
• Block the sending IPs and spoofed domains listed in the IOCs at the mail gateway and proxy
• Quarantine inbound archive attachments (.7z, .rar, .tar, .zip) containing JavaScript or executables
• Hunt for mshta or PowerShell launched from the Run dialog, and for msbuild.exe, regasm.exe or regsvcs.exe making external network connections

Workarounds

• Restrict Windows Run dialog and mshta execution via application control where not required
• Disable browser password and cookie persistence on managed endpoints where policy allows

Longer-term hardening

• Bind sessions to device and IP context and shorten session lifetimes for banking and SSO applications
• Adopt phishing-resistant, device-bound authentication where feasible
• Build a cyber-fraud fusion workflow that ties credential-theft intelligence to fraud and mule-account signals
• Monitor underground markets and stealer-log feeds for corporate and customer credentials
• Train staff and customers on ClickFix prompts, fake software downloads, and callers requesting one-time codes
• Enforce SPF, DKIM and DMARC and flag lookalike-domain registrations

Affected and fixed versions

• Multiple — Windows endpoints and Chromium/Gecko-based browsers (saved credentials, cookies, SSO tokens)
  Vulnerable versions: Not version-specific; abuse of stored browser data
• Financial institutions — Online banking and corporate SSO/SaaS sessions
  Vulnerable versions: Sessions protected only by cookie-based post-authentication trust

Timeline of Lumma RisePro session theft

• 2025-01-01 INTERPOL-coordinated Operation Secure begins (January 2025), targeting infostealer infrastructure across Asia with law enforcement from more than 25 countries.
• 2025-04-30 Operation Secure concludes (April 2025): 20,000+ malicious IPs/domains taken down, 41 servers seized, 100+ GB of data recovered, 32 arrests (18 Vietnam, 14 Sri Lanka and Nauru) and 216,000+ victims notified; Hong Kong police found 117 C2 servers across about 89 ISPs.
• 2025-05-21 Microsoft Digital Crimes Unit and partners disrupt locked-ioc-11, taking down about 2,300 domains; Microsoft publishes its technical analysis of Lumma delivery and C2.
• 2025-11-01 Group-IB begins tracking a locked-ioc-7 phishing campaign (from November 2025) against European logistics, manufacturing and technology organizations, using procurement-themed lures impersonating an equipment trader.
• 2026-01-31 locked-ioc-7 campaign observed through January 2026 after five waves with archive attachments containing JavaScript droppers or executables; emails failed SPF and lacked DKIM.
• 2026-11-06 Group-IB publishes research on infostealer-driven banking fraud, describing the one-log-feeds-four-crimes model, session-cookie MFA bypass and the cyber-fraud detection gap.

Sources cited for Lumma RisePro session theft

• INTERPOL: 20,000 malicious IPs and domains taken down in INTERPOL infostealer crackdown interpol.int · Advisory
• Microsoft: Lumma Stealer - delivery techniques and capabilities of a prolific infostealer Microsoft · Vendor report · 2025-05-21
• Cyfirma: Lumma Stealer tactics, impact and defense strategies cyfirma.com · Research
• Infostealers In Banking Fraud: How Stolen Credentials Lead To Silent Intrusions group-ib.com · Blog · 2026-11-06
• Group-IB: Phantom Stealer credential theft group-ib.com · Blog
• Bitdefender: 216,000 victims notified as INTERPOL unravels major infostealer ring bitdefender.com · News
• Infosecurity Magazine: Phantom Project bundles infostealer, crypter and RAT for sale infosecurity-magazine.com · News
• Security Affairs: Operation Secure - INTERPOL dismantles 20,000+ malicious IPs securityaffairs.com · News

More in malware

• GhostBat Android Banking Malware Targets 60 Banking and Payment Apps in India
• Armorsteal: Python Malware Kit Delivered via SEO-Poisoned Fake Download Pages Steals Data and Mines Crypto
• Marsalek Malware-as-a-Service Hidden in Fake Roblox, Minecraft and Fortnite Cheats Delivers PureLog Stealer
• laZzzy Donut: Multi-Stage Loader Chain (Kramer-obfuscated Python, Donut shellcode, laZzzy loader)
• BTMob Android RAT: February 2026 Source Code Leak Expands Access and Resale