Underground Turmoil: How Doxxing and Infighting Paralyzed Lumma Stealer

Lumma Stealer’s Sudden Fall from Grace

The once-dominant Lumma Stealer malware operation is facing unprecedented disruption following a comprehensive doxxing campaign that exposed its core developers and administrators. Between August and October 2025, sensitive personal information of five key individuals allegedly responsible for the malware’s development and operational oversight was leaked on a website called “Lumma Rats,” revealing passport numbers, bank account details, email addresses, and online profiles.

Lumma Stealer’s Sudden Fall from Grace
Internal Collapse and Operational Disruption
The Rise and Fall of a Cybercrime Giant
Shifting Landscape in the Cybercrime Underground
Implications for Cybersecurity and Law Enforcement

According to Trend Micro’s analysis, the exposure campaign appears to have been orchestrated by competing cybercrime groups, highlighting the volatile nature of the criminal underground. The security firm noted that the campaign’s consistency and depth suggest either insider knowledge or access to compromised accounts and databases.

Internal Collapse and Operational Disruption

The doxxing campaign triggered a cascade of operational failures for the Lumma Stealer operation. In September, the group suffered a critical blow when their Telegram accounts were compromised on September 17, severely disrupting their ability to communicate with customers and coordinate malicious activities. A representative of the group reportedly posted on an underground forum that their Telegram accounts had been stolen, further eroding trust among their criminal clientele., according to market insights

Trend Micro observed a significant decline in new command and control (C2) infrastructure activity and a reduction in targeted endpoints during this period. The exposure campaign was accompanied by threats and accusations of betrayal within the cybercriminal community, with claims that the Lumma Stealer team had prioritized profit over operational security., according to industry experts

The Rise and Fall of a Cybercrime Giant

Lumma Stealer first emerged in 2022 and quickly rose to become one of the most notorious information stealers in the cybercrime ecosystem. Its position at the top of the malware food chain made it a prime target for both law enforcement operations and competing criminal groups. The malware’s capabilities align with established cyberattack patterns documented in frameworks like MITRE ATT&CK’s malware database., according to recent innovations

The recent disruptions represent the second major blow to Lumma Stealer in recent years. In May 2024, Microsoft and law enforcement partners disrupted the infrastructure behind the malware by blocking over 2,000 domains, identifying 394,000 infected Windows computers, and seizing the Lumma control panel., as related article, according to further reading

Shifting Landscape in the Cybercrime Underground

The paralysis of Lumma Stealer has created a power vacuum in the information stealer market, with cybercriminals rapidly migrating to alternative solutions. Trend Micro reports that Vidar and StealC have emerged as the primary replacement options, with many users citing Lumma Stealer’s instability and loss of support as key reasons for switching.

The ripple effects extend beyond direct competitors. Pay-per-install (PPI) services like Amadey, which were widely used to deliver Lumma Stealer payloads, have also experienced reduced demand. This demonstrates how interconnected the cybercrime ecosystem has become and how disruptions to major players can impact ancillary services.

Implications for Cybersecurity and Law Enforcement

This episode reveals several important trends in the fight against cybercrime. First, it demonstrates that criminal groups are vulnerable to the same types of attacks they perpetrate against others. Second, it shows that internal conflicts and competition within the cybercrime world can sometimes achieve what traditional law enforcement methods cannot.

The doxxing of Lumma Stealer’s developers represents a significant moment in the ongoing battle against information stealers, highlighting how criminal operations can collapse from internal pressure and competition as effectively as from external law enforcement actions. While the long-term impact remains uncertain, the immediate effect has been to disrupt one of the most prominent threats in the cybercrime landscape and force malicious actors to regroup and rebuild.

As the cybercrime ecosystem continues to evolve, such internal conflicts may become more common as competition intensifies and stakes increase in the lucrative world of information stealing malware.