Microsoft (MSFT, Financial) has announced a major cybersecurity operation in collaboration with international law enforcement, effectively dismantling the "Lumma Stealer" malware network. From March 16 to May 16, over 394,000 Windows computers across the globe were infected with this malicious software, which is known for stealing sensitive data such as passwords, credit card information, and cryptocurrency wallets.
The Lumma malware, favored by cybercriminals for its ability to circumvent security barriers, was a prime tool for online threat actors. The operation led by Microsoft’s Digital Crimes Unit, backed by authorization from a U.S. federal court in Georgia, involved seizing over 1,300 domains linked to Lumma. These domains were redirected to Microsoft-controlled sinkholes to sever connections between the malware and its victims.
Key partners in this operation included the U.S. Department of Justice, Japan's Cybercrime Control Center, and Europol, with technical support from companies like Cloudflare and Lumen. Microsoft's commitment to cybersecurity extends to monitoring threats in industries like travel, gaming, education, and critical infrastructure, where Lumma has been active since 2022.
