LummaStealer dropped via fake updates from itch.io and Patreon

▤ Summary

Attackers spam comments on Itch.io with Patreon links claiming to be game updates that download Updated Version.zip, whose game.exe is a nexe-compiled Node.js executable that ultimately delivers a LummaStealer payload. Analysis shows the malware writes and loads a modules.node DLL to reflectively load the stealer and uses multiple anti-analysis checks (VM, sandbox usernames, process lists, video adapter, refresh rate, disk model) to evade detection. Researchers found multiple variants and encoding methods across different download URLs, indicating an ongoing, evolving campaign. Itch.io removed some malicious accounts but new ones continue to appear, leaving developers and users at risk if they install purported updates.

▦ Linked Companies

Malwarebytes Inc

$100M to $250M

itch.io

$1M to $5M