Lumma Stealer
Named by 2 kept items in this workspace.
1 items name it under classification.key entities and 1 under threat actors.
Search every workspace for Lumma Stealer. It matches the name as written, so it can find other things that share it.
The items that name it 2
Referenced 2025 campaign that stuffed payloads into .wav, .mp3, .png and .mp4 files behind a PureCrypter layer, cited as precedent for the WAV-hiding technique used in this campaign.
All threat actors in this workspace.