Lumma: Base64-encoded PowerShell
Lumma Stealer profileAccording to CISA and FBI, when the user pastes the clipboard command into the Run dialog and presses Enter, a Base64-encoded PowerShell process starts. CISA and FBI (AA25-141B)
(LOTL)
An attacker using legitimate programs already present in the operating system instead of bringing their own tools.
Tools such as PowerShell, mshta, rundll32 or osascript on macOS exist on every system and are signed. When an attacker uses them, no new file is written; a trusted program is simply run. MITRE ATT&CK
This approach is very common in infostealer distribution: a one-line command the user is tricked into pasting downloads the real payload through the system’s own script interpreter. CISA and FBI (AA25-141B)
PowerShell, mshta or osascript is started. MITRE ATT&CK
An encoded script, or one fetched from the internet, is run. MITRE ATT&CK
The tool downloads and starts the actual malware. MITRE ATT&CK
According to CISA and FBI, when the user pastes the clipboard command into the Run dialog and presses Enter, a Base64-encoded PowerShell process starts. CISA and FBI (AA25-141B)
According to Zscaler, MacSync’s second-stage script runs in Terminal and the downloaded content is passed directly to osascript. Zscaler
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy