{"id":215473,"date":"2026-02-15T11:30:00","date_gmt":"2026-02-15T16:30:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/02\/15\/lumma-stealer-and-ninja-browser-malware-campaign-abusing-google-groups\/"},"modified":"2026-02-19T19:55:11","modified_gmt":"2026-02-20T00:55:11","slug":"lumma-stealer-and-ninja-browser-malware-campaign-abusing-google-groups","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/02\/15\/lumma-stealer-and-ninja-browser-malware-campaign-abusing-google-groups\/","title":{"rendered":"Lumma Stealer and Ninja Browser malware campaign abusing Google Groups"},"content":{"rendered":"

Lumma Stealer and Ninja Browser malware campaign abusing Google Groups<\/a><\/p>\n

https:\/\/www.bleepingcomputer.com\/news\/security\/ctm360-lumma-stealer-and-ninja-browser-malware-campaign-abusing-google-groups\/<\/a><\/p>\n

Publish Date: 2026-02-15 11:30:00<\/a><\/p>\n

Source Domain: www.bleepingcomputer.com<\/a><\/p>\n

\n

CTM360 reports that more than 4,000 malicious Google Groups and 3,500 Google-hosted URLs are being used in an active malware campaign targeting global organizations.<\/p>\n

The attackers abuse Google\u2019s trusted ecosystem to distribute credential-stealing malware and establish persistent access on compromised devices.<\/p>\n

The activity is global, with attackers embedding organization names and industry-relevant keywords into posts to increase credibility and drive downloads.<\/p>\n

Read the full report here: https:\/\/www.ctm360.com\/reports\/ninja-browser-lumma-infostealer<\/p>\n

How the campaign works<\/h2>\n

The attack chain begins with social engineering inside Google Groups. Threat actors infiltrate industry-related forums and post technical discussions that appear legitimate, covering topics such as network issues, authentication errors, or software configurations<\/p>\n

Within these threads, attackers embed download links disguised as: \u201cDownload {Organization_Name} for Windows 10\u201d<\/p>\n

To evade detection, they use URL shorteners or Google-hosted redirectors via Docs and Drive. The redirector is designed to detect the victim\u2019s operating system and deliver different payloads depending on whether the target is using Windows or Linux
\n\u00a0<\/p>\n

\"Malware<\/p>\n

Windows Infection Flow: Lumma Info-Stealer<\/h2>\n

For Windows users, the campaign delivers a password-protected compressed archive hosted on a malicious file-sharing infrastructure<\/p>\n

Oversized archive to evade detection<\/h3>\n

The decompressed archive size is approximately 950MB, though the actual malicious payload is only around 33MB. CTM360 researchers found that the executable was padded with null bytes \u2014 a technique designed to exceed antivirus file-size scanning thresholds and disrupt static analysis engines.<\/p>\n

AutoIt-based reconstruction<\/h3>\n

Once executed, the malware:<\/p>\n