Lumma Malware Infects 394,000 Windows PCs Worldwide Says Microsoft

In news from the cyber community this week, Microsoft took aim at malware known as Lumma, fast becoming the go-to malware weapon for cybercriminals. The Windows company reported that more than 394,000 Windows computers around the world were infected with this malware between March 16 and May 16. This shocking number underscores just how far-reaching this hacking tool is.

Coordinated Response With Law Enforcement

In partnership with law enforcement officials from across the world, Microsoft released a full technical analysis of the Lumma Stealer operation. This operation succeeded in seizing or transferring more than 1,300 domains. Approximately 300 of those actions were carried out with the support of Europol. These domains would be pointed to Microsoft sinkholes in order to prevent future abuse.

The digital crimes unit at Microsoft noticed the extensive infection. Actor TTPs and motivations They observed that Lumma malware had been for sale on underground online forums since at least 2022. Cyber criminals have used Lumma to carry out all sorts of financial crimes, as its features are being leveraged to deceive users in sophisticated ways through phishing schemes. Perhaps the most damning example was one that played out in March of 2025, when hackers posed as Booking.com, luring travelers into surrendering personal details.

Local law enforcement in Japan was a key partner in this operation. They provided political cover for the suspension of Lumma’s infrastructure, as well as seizing domains. This unprecedented coordinated global effort led by Europol demonstrates Microsoft’s strong commitment to continuing the fight against cybercrime and protecting users from emerging malicious threats.

“Working with law enforcement and industry partners, we have severed communications between the malicious tool and victims,” – Microsoft

Legal Tools Enable Takedown

The legal framework enabling this unprecedented action consisted of a court-approved consent order giving Microsoft operational control over Lumma’s infrastructure. This legal win gives Microsoft new tools to stop the malware’s operations and reduce its impact on users.

The gang responsible for Lumma malware never stopped working on its tools, creating a jealously guarded IT security nightmare that still haunts cybersecurity experts. Microsoft’s blog post describing the collaborative takedown made an excellent point. These types of threats are best addressed through collaboration.

As these cybercriminals adapt and modify their strategies, Microsoft’s proactive involvement in worldwide efforts to combat dangers such as Lumma are crucial. The company’s actions are a clear signal that they are taking a proactive approach to ensuring user safety and protecting the integrity of technology infrastructure across the globe.

Featured image credit: Crowd via GoodFon

For more stories like it, click the +Follow button at the top of this page to follow us.