Overview

• Microsoft, the U.S. Department of Justice, Europol, and Japan’s Cybercrime Control Center collaborated to disrupt the Lumma infostealer malware network.
• The operation seized approximately 2,300 domains and dismantled Lumma’s command infrastructure and online marketplaces.
• Lumma infected over 394,000 Windows systems globally between March and May 2025, stealing credentials, financial data, and cryptocurrency wallets.
• Cloudflare and other tech firms played a critical role by blocking domains, banning accounts, and sinkholing malicious servers to sever Lumma’s operations.
• The malware, developed in Russia and marketed as a service, has been a key tool for cybercriminals, enabling large-scale financial theft and network breaches.