Campaign record
Lumma Stealer via GitHub issue mail
Lumma Stealer delivered through abused GitHub issue notifications
- Status as last assessed
- Active
- First seen
- 2024-09-18
- Last seen
- 2024-09-18
- Indicators
- 12
- Sources
- 1
- Targets
- Windows
- Fake CAPTCHA verification
- Lumma Stealer
- Abused platform notification email
Original research
- Proofpoint2024-11-14Vendor researchFirst account
Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape
This page summarises and structures that research; it is not a substitute for the original.
Researchers: if anything here misrepresents your work, email corrections@clickfixreport.com — we correct within 5 working days, no questions asked.
Summary
Proofpoint dated this activity to 18 September 2024. The operators abused GitHub's own mail: by opening an issue or leaving a comment on a repository they caused GitHub to notify everyone subscribed to it, carrying the attacker's wording inside a message that genuinely originated at the platform. The wording posed as a security alert and pointed readers at github-scanner[.]com, a counterfeit of the site. That page ran an off-the-shelf fake-CAPTCHA kit and padded the clipboard so the victim would not spot the real instruction once it sat in the Run box. Executing it fetched a binary and ended in Lumma Stealer. Around 300 organisations worldwide showed up as affected in Proofpoint's own telemetry. Seven .shop control domains and one Steam profile page are published alongside two payload hashes.
What changed since publication
The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.
- Indicators checked
- 6 of 12
- Checks recorded
- 12
- Checks since publication
- 12
- Never checked
- 6
Observation window 2026-08-10 to 2026-08-22. Checks are sampled, not continuous; the sampling policy is on /methodology. 6 indicators have never been checked by us at all.
Current recorded state
- 6 Unregistered
- 6 Not checked by us
Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.
Execution mechanisms
The only execution mechanism any published account describes for this campaign is Windows Run dialog (T1204.004), which 23 of the 44 published campaigns in this corpus also record (52%).
Indicators
12 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.
“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.
Not on this record
This record does not yet carry a second publisher's account or any overlap with another campaign in this corpus. Each appears on this page as its own section once it exists; none of it is inferred.
Cite as
ClickFixReport, “Lumma Stealer via GitHub issue mail”, campaign ID c28a85bb, retrieved 2026-08-07, snapshot fb0eed7.
https://clickfixreport.com/campaigns/c28a85bb/lumma-stealer-github-notification-clickfix
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.