Lumma Stealer via film piracy sites

Summary

Microsoft describes a chain running in April 2025 that fed on people hunting for films to watch without paying. Touching the player on those sites — a press of the play control was enough — threw open new tabs of scam pages, and one of them was a ClickFix lure whose end result was Lumma Stealer on the machine. Volume is what marks the cluster out: on a single day the redirectors could push tens of thousands, possibly hundreds of thousands, of separate visitors into those pages. Its other habit is renaming the intermediate HTA scripts to look like media, with endings such as .mp3, .mp4 or .ogg, so a downloaded file reads as a song or a clip rather than something executable. The host named in the pasted command is recorded as tesra[.]shop, seen on 2 April 2025.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

Both of these mechanisms appear together in 5 of the 44 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

1 indicator, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.