Microsoft Corporation (MSFT) and Global Law Enforcement Dismantle Lumma Stealer Malware Network Infecting 394,000 Devices

Microsoft Corporation (NASDAQ:MSFT) revealed Wednesday that it has dismantled the Lumma Stealer malware operation, which infected more than 394,000 Windows devices worldwide from March 16 to May 16. The malware, widely used by hackers, stole passwords, credit cards, bank information, and cryptocurrency wallets.

Using a court order from the U.S. District Court for the Northern District of Georgia, MSFT’s Digital Crimes Unit seized critical web domains powering Lumma’s infrastructure. The U.S. Department of Justice took control of the malware’s command servers and shut down online marketplaces selling the malware. Europol and other partners helped seize over 1,300 domains, many redirected to Microsoft sinkholes.

Tech companies, including Cloudflare, Bitsight, and Lumen, also joined the operation. Japan’s cybercrime control center suspended the local Lumma infrastructure.

Since 2022, Lumma has been a top tool for cybercriminals due to its advanced capabilities and ease of spreading. Microsoft highlighted its role in a March 2025 phishing scam impersonating Booking.com. The malware also targeted online gaming, education, manufacturing, logistics, and healthcare sectors.

Microsoft Corporation confirmed the takedown breaks the link between attackers and victims, disrupting a major global cybercrime network and stopping ongoing financial theft and data breaches.

READ NEXT: 10 Best Cancer Stocks to Invest in for Long-Term Gains and 10 Most Oversold Stocks to Buy According to Billionaires.