Microsoft reveals password stealer malware found on close to 4 lakh Windows PCs

Microsoft’s Digital Crimes Unit (DCU) and global partners have disrupted Lumma Stealer, one of the most prolific info-stealing malware tools used by cybercriminals. Through a court-authorized takedown on May 13, Microsoft and law enforcement agencies seized over 2,300 domains forming Lumma’s infrastructure, delivering a critical blow to cybercrime networks targeting sensitive personal and institutional data.

Lumma, a Malware-as-a-Service (MaaS) marketed on underground forums since 2022, specializes in stealing passwords, banking credentials, cryptocurrency wallets, and more. Its victims range from individual consumers to schools, banks, and critical service providers. Microsoft identified more than 394,000 Windows systems infected with Lumma between March and May 2025 alone. A majority of these systems were in Brazil, US and parts of Europe.

The operation, approved by the US District Court for the Northern District of Georgia, saw coordination between Microsoft, the U.S. Department of Justice, Europol, and Japan’s Cybercrime Control Center. The DOJ dismantled Lumma’s command infrastructure, while law enforcement helped suspend local networks supporting the malware.

Microsoft is redirecting more than 1,300 seized or transferred domains to its “sinkholes”—a defensive infrastructure that intercepts malicious traffic to monitor and disrupt further attacks. Insights from these sinkholes will aid public and private cybersecurity efforts to investigate, track, and neutralize threats linked to Lumma.