# Infostealers in Banking Fraud: Stolen Credentials and Session Cookies Enable Silent Intrusions (Lumma, RisePro, METAStealer, Phantom Stealer)

> Group-IB reports that a single infostealer log feeds account takeover, mule account onboarding, session hijacking and ransomware support. Stolen session cookies are replayed after authentication, so MFA does not stop this vector, and the credential-theft stage falls into a detection gap between cyber and fraud teams.

- **Published:** 2026-11-06T07:33:36Z
- **Last reviewed:** 2026-11-06T07:33:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5386
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5386.png
- **ID:** TL-2026-5386
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (3 shown free below)

## Description

Group-IB (published 2026-11-06) describes a commercialized fraud-as-a-service ecosystem in which stealer-as-a-service subscriptions (Lumma, RisePro, METAStealer, Phantom Stealer), phishing kits, pre-harvested credential logs, seasoned mule accounts and cash-out services are each rented separately. The malware copies saved passwords, session cookies, autofill data and corporate SSO tokens from browsers. Victims typically notice nothing and no perimeter alert fires. In the typical sequence a customer downloads an apparently legitimate tool (a free PDF converter or a fake search result), the stealer executes, harvests and self-deletes, and six or more weeks can pass before the stolen data is used for an unauthorized login, a social-engineered MFA bypass or a fund transfer.

Session cookies are post-authentication tokens, so replaying them gives access to an already-trusted session without re-authenticating. Where a fresh login is needed, attackers phone victims while impersonating the bank to obtain one-time codes. A single log feeds four crimes: account takeover, mule account onboarding, session hijacking and ransomware support, and corporate access via SSO tokens. Pre-seasoned mule accounts at multiple banks pass KYC checks before showing suspicious behaviour. Group-IB notes that the most valuable corporate access (domain admin, VPN panels, SaaS logins) has moved into private channels, with public corporate access listings down 27%.

Operation Secure, an INTERPOL-coordinated action from January to April 2025, targeted infostealer infrastructure. It involved law enforcement in more than 25 countries and addressed nearly 70 malware variants. Results: 20,000+ malicious IPs and domains taken down, 41 servers seized, 100+ GB of data recovered, 32 arrests (18 in Vietnam, 14 in Sri Lanka and Nauru) and 216,000+ victims notified. Hong Kong police found 117 C2 servers across about 89 ISPs. Group-IB contributed intelligence on Lumma, RisePro and METAStealer.

Lumma technical detail (Microsoft, 2025-05-21): delivery by ClickFix/fake CAPTCHA, malvertising, phishing, drive-by JavaScript, cracked software, GitHub-hosted lures and secondary delivery by loaders such as DanaBot. The execution chain is mshta then PowerShell then the Lumma executable, with process hollowing into msbuild.exe, regasm.exe, regsvcs.exe or explorer.exe. C2 traffic is HTTPS behind Cloudflare, with fallback C2s resolved via Steam profiles and Telegram channels, and the C2 protocol version is 4.0. It targets Chromium and Gecko browser data, crypto wallets and extensions, VPN (.ovpn) files, email, FTP and Telegram clients, and documents. Microsoft DCU and partners took down about 2,300 Lumma domains on 2025-05-21 and attributed the service to Storm-2477, with affiliates including Octo Tempest, Storm-1607, Storm-1113 and Storm-1674.

Phantom Stealer (Group-IB, tracked November 2025 to January 2026): a .NET stealer sold in the 'Phantom Project' bundle (stealer, crypter, RAT). Five phishing waves hit logistics, manufacturing and technology organizations in Europe. The emails impersonated an equipment trader with procurement/request-for-quote subjects, and carried .tar/.7z/.zip/.rar archives containing obfuscated JavaScript droppers or executables. It harvests browser passwords, cookies, autofill and payment cards, Discord/Telegram/Outlook session data and Wi-Fi credentials, and exfiltrates via Telegram, Discord, SMTP or FTP. Emails failed SPF and lacked DKIM.

The article names no specific threat actors; activity is attributed to service users renting tools. Severity is analyst-assessed (no CVE or CVSS). The article lists no IOCs of its own, so the IOCs here come from the cited Group-IB Phantom Stealer report and Microsoft's Lumma analysis. Group-IB recommends cyber-fraud fusion workflows, upstream detection weeks before transactions, tracking criminal payment details and money flows, flagging newly onboarded mule accounts, and monitoring underground markets for harvested logs.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1218.005 Mshta
- T1055.012 Process Hollowing
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1550.004 Web Session Cookie
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1583.001 Domains
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Lumma ClickFix - mshta Remote Script Execution or PowerShell Child of mshta** (`TL-2026-5386-SPL-001`)

TL-2026-5386: detects the Lumma Stealer ClickFix/fake-CAPTCHA execution chain in which mshta.exe fetches JavaScript from an attacker host (http/https/javascript: argument) and then launches PowerShell for follow-on scripts, ahead of process hollowing and credential harvesting. mshta with a remote URL is rare in normal enterprise operation, so this is a behaviour-first, high-fidelity early signal.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1218.005, T1204.004, T1059.001
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ((Image="*\\mshta.exe" (CommandLine="*http://*" OR CommandLine="*https://*" OR CommandLine="*javascript:*")) OR (ParentImage="*\\mshta.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe"))) | eval chain=if(match(Image,"(?i)mshta\\.exe$"),"mshta_remote_content","mshta_spawns_powershell") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host User chain | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ 'mshta.exe' and ProcessCommandLine matches regex @'(?i)(https?://|javascript:)')
    or (InitiatingProcessFileName =~ 'mshta.exe' and FileName in~ ('powershell.exe', 'pwsh.exe'))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
```

### Sigma

```yaml
title: Lumma ClickFix mshta Remote Script and PowerShell Child
id: 3f1c7a52-8d4e-4b6a-9c21-5e7a0b9d1f43
status: experimental
description: Detects mshta.exe loading remote content or spawning PowerShell, the ClickFix execution chain used to deliver Lumma Stealer (TL-2026-5386).
references:
  - https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/
  - https://www.group-ib.com/blog/infostealers-banking-fraud-stolen-credentials/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_mshta_remote:
    Image|endswith: '\mshta.exe'
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'javascript:'
  selection_mshta_child:
    ParentImage|endswith: '\mshta.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: 1 of selection_*
falsepositives:
  - Legacy HTA-based line-of-business applications launched from a URL
  - Software deployment scripts that invoke mshta
level: high
```

**Known false positives:**

- Legacy HTA-based line-of-business applications launched from an internal URL
- Software deployment or inventory scripts that call mshta.exe

**Tuning notes:** Allowlist known internal HTA application hosts by URL or hash. Adjust the index name to your Sysmon index. Where Sysmon is not deployed, use Security 4688 with command-line auditing enabled. Escalate to high priority when the parent of mshta.exe is explorer.exe (Run dialog).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Phantom Stealer Phishing - Archive Attachment from Campaign Infrastructure or Spoofed Procurement Lure (locked: unlock with TL Creds)
- Stolen Session Cookie Replay - Same Entra Session from Multiple IPs and Countries (locked: unlock with TL Creds)
- Infostealer C2 and Exfiltration - Campaign and Community Domains, Telegram/Discord/Steam from Non-Browser Process (locked: unlock with TL Creds)
- Phantom Stealer JavaScript Dropper Executed from Archive Extraction or Temp Path (locked: unlock with TL Creds)
- ClickFix Run Dialog PowerShell Download Cradle or CAPTCHA Lure Command (locked: unlock with TL Creds)
- DNS Lookup of Lumma, Phantom Stealer and Community-Observed ClickFix Domains (locked: unlock with TL Creds)
- Infostealer Browser Credential and Cookie Store Staged by Non-Browser Process (locked: unlock with TL Creds)
- Lumma Process Hollowing Hosts - msbuild/regasm/regsvcs Outbound Connection (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 16)

Defanged, TLP:CLEAR.

- IP address: `108.171.108[.]248`
- Domain: `scxzswx[.]lovestoblog[.]com`
- IP address: `216.131.75[.]250`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Infostealers In Banking Fraud: How Stolen Credentials Lead To Silent Intrusions](https://www.group-ib.com/blog/infostealers-banking-fraud-stolen-credentials/)
- [Group-IB: Phantom Stealer credential theft](https://www.group-ib.com/blog/phantom-stealer-credential-theft/)
- [Microsoft: Lumma Stealer - delivery techniques and capabilities of a prolific infostealer](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/)
- [INTERPOL: 20,000 malicious IPs and domains taken down in INTERPOL infostealer crackdown](https://www.interpol.int/en/News-and-Events/News/2025/20-000-malicious-IPs-and-domains-taken-down-in-INTERPOL-infostealer-crackdown)
- [Bitdefender: 216,000 victims notified as INTERPOL unravels major infostealer ring](https://www.bitdefender.com/en-us/blog/hotforsecurity/216-000-victims-notified-as-interpol-unravels-major-infostealer-ring)
- [Infosecurity Magazine: Phantom Project bundles infostealer, crypter and RAT for sale](https://www.infosecurity-magazine.com/news/phantom-project-infostealer-nov-25/)
- [Security Affairs: Operation Secure - INTERPOL dismantles 20,000+ malicious IPs](https://securityaffairs.com/178898/cyber-crime/operation-secure-interpol-dismantles-20000-malicious-ips-in-major-cybercrime-crackdown.html)
- [Cyfirma: Lumma Stealer tactics, impact and defense strategies](https://www.cyfirma.com/research/lumma-stealer-tactics-impact-and-defense-strategies/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5386