Lumma Stealer and Ninja Browser malware campaign abusing Google Groups
A malicious campaign exploiting Google Groups to distribute Lumma Stealer and Ninja Browser malware has been uncovered. The attackers infiltrate industry-related forums, posting seemingly legitimate technical discussions with embedded malicious download links. For Windows users, the payload is Lumma Stealer, a credential-harvesting malware. Linux users are directed to download a trojanized Chromium-based browser called Ninja Browser, which installs malicious extensions and persistence mechanisms. The campaign utilizes Google's trusted ecosystem to bypass security measures and increase user confidence. Over 4,000 malicious Google Groups and 3,500 Google-hosted URLs have been identified in this global operation, posing significant risks to organizations including credential theft, account takeover, and remote command execution.
Pulse ID: 6992f518e91138231dcf4d24
Pulse Link: https://otx.alienvault.com/pulse/6992f518e91138231dcf4d24
Pulse Author: AlienVault
Created: 2026-02-16 10:44:40
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Browser #CyberSecurity #Google #InfoSec #Linux #LummaStealer #Malware #OTX #OpenThreatExchange #RAT #RemoteCommandExecution #Rust #SMS #Trojan #Windows #bot #AlienVault
![Screenshot van een SMS van +31 6 24104037
met de phishing tekst:
[ODIDO]
Uw simkaart is verouderd. Vernieuw deze eenvoudig via: klant-info.bio om onze diensten te blijven gebruiken.](https://files.mastodon.social/cache/media_attachments/files/116/079/447/604/856/792/small/f5bd68325feb1221.png)


