Threat researchTracked by EncryptLayer intelligence
Lumma Stealer in a 900 MB torrent screensaver
- Published by
- Have I Been Squatted
- Published
- 28 Oct 2026
- Indicators
- 10 verified
The report
Lumma Stealer v6 hides in a 900 MB screensaver delivered through a fake TV torrent. We trace its loader, C2 infrastructure, and clipboard and screenshot theft.
Read the full analysis: Lumma Stealer in a 900 MB torrent screensaver (Have I Been Squatted).
Indicators
Malware C
- businway[.]cyou
- citymket[.]cyou
- creaflow[.]cyou
- futurtep[.]cyou
- smaridge[.]cyou
- starzone[.]cyou
- toolsep[.]biz
- trendion[.]cyou
- valuidge[.]cyou
- visioint[.]cyou
Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.
How this is tracked
EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#29). This page is generated from that record and the report’s own title and summary; nothing is rewritten.