Lumma Stealer is a malware-as-a-service info-stealer sold on underground forums that harvests browser credentials, cookies, and crypto wallet data.
FlashPoint pulled 555 AI-service tokens out of a single 44,791-token stealer dump, 24 of them still valid, and five dollars is the Telegram bulk price because a copied session leaves the victim's own login working.
Reality
Prophet Security investigated every alert in its customers' environments from May through July and found account takeovers turned on how the intruder arrived, with stolen passwords usually stopped and stolen sessions running for weeks.
Reality
Okta's read of one Telegram stealer dump shows commodity malware now hoovering up AI session tokens and API keys, and a replayed token walks past MFA because the second factor was spent when the token was minted.
Reality
Microsoft says the technique now reaches thousands of enterprise and end-user devices every day. Because the employee is the one who runs the code, the control that binds is a rule about pasting into shells rather than another agent.
Reality
Forcepoint's X-Labs found short-lived ClickFix domains carrying white-on-white characters and zero-width spaces, which puts the trust boundary for any agent you point at the open web inside your own extraction code.
Reality
A Raxis post catalogues three campaigns that made GitHub the delivery host rather than the hiding place, which is why the 1,300 repositories flagged as open to RepoJacking matter more than the million-device headline above them.
Reality