This week, Tanium’s Cyber Threat Intelligence (CTI) team examines three emerging threats shaping the current threat landscape. First is Katz Stealer, a recently surfaced malware-as-a-service (MaaS) platform rapidly gaining traction among threat actors. Next is the reemergence of Lumma Stealer, a notorious information-stealing malware. Finally, the team explores NailaoLocker, a ransomware variant targeting Windows systems.
Katz Stealer: A notorious turnkey infostealer targeting credentials and crypto
SentinelOne issued an advisory about Katz Stealer, a newly emerged MaaS platform engineered to exfiltrate credentials, crypto wallet data, and other sensitive assets.
Katz Stealer provides cybercriminals with a customizable and user-friendly platform for data theft. The “turnkey” nature of the malware, along with its stealthy capabilities, has contributed to its rapid adoption.
Modular payloads and affiliate-driven campaigns
Affiliates pay for access to a web-based management panel that allows them to generate customized malware builds. These builds can be tailored by toggling features such as anti-VM checks, data theft modules, and delivery formats. This flexibility, combined with a slick user interface, enables threat actors to launch and manage campaigns with minimal friction.
Stealthy delivery and execution chain
Katz Stealer typically arrives via phishing emails or trojanized downloads containing obfuscated JavaScript droppers. These droppers execute PowerShell commands to retrieve malicious image files embedded with steganographic payloads.
Once deployed, the malware elevates privileges using UAC bypass, establishes persistence through scheduled tasks, and evades detection via anti-analysis checks and process hollowing.
Comprehensive data theft capabilities
The malware targets a wide array of applications and services. It extracts credentials, tokens, and autofills data from browsers; harvests information from messaging, gaming, email, FTP, and VPN clients; and captures screenshots, audio, and video. Its crypto-theft capabilities are particularly aggressive, scanning for over 150 browser extension IDs and desktop wallet artifacts.
Browser injection and encryption workarounds
By injecting into browser processes, Katz Stealer can access sensitive data through exposed APIs. SentinelOne’s technical analysis also details how the malware circumvents encryption mechanisms designed to protect stored credentials and wallet data.
Persistent command-and-control (C2) communication and continuous exfiltration
Each malware instance includes a hardcoded C2 address and campaign ID. Once active, it maintains a persistent connection to the C2 server, continuously exfiltrating updated victim data—underscoring its role as a long-term surveillance and theft tool rather than a one-time hit.
“Katz Stealer is not a ‘one shot’ infostealer; it is designed to continually exfiltrate the victim’s data.”SentinelOne
Analyst comments from Tanium’s Cyber Threat Intelligence team
Katz Stealer is the latest example of how cybercrime is becoming increasingly commoditized, and lowering the barrier of entry for threat actors.
Katz Stealer’s focus on crypto wallets and browser-stored credentials also suggests that threat actors are adapting to modern day enterprise tech stacks to be as impactful as possible.
Katz Stealer is now being widely adopted among attackers, which could potentially result in an influx of credential-based attacks. That said, only time will tell how successful this infostealer becomes in a landscape flooded with infostealers.
Lumma Stealer reemerges with enhanced stealth and modular power
Following a law enforcement takedown in May 2025, Lumma Stealer has returned with upgraded stealth techniques and modular architecture—making it more evasive and adaptable across diverse attack vectors.
Trend Micro warns that this evolution demands renewed vigilance and layered defense strategies.
Law enforcement disruption and claimed recovery
The takedown operation dismantled over 2,300 malicious domains, severing communication between infected machines and Lumma’s infrastructure.
However, the group behind Lumma later claimed on underground forums that the core server was not confiscated but rather accessed via a vulnerability. They asserted that server access was restored shortly after the disruption.
Rapid infrastructure rebuild and operational resurgence
Trend Micro’s telemetry shows that Lumma Stealer’s infrastructure was quickly reactivated within weeks of the takedown. While activity dipped temporarily, it soon returned to pre-disruption levels, signaling a resilient and determined threat actor.
Shift in network obfuscation tactics
Previously, Lumma relied heavily on Cloudflare to mask its malicious domains. Post-takedown, Trend Micro observed a strategic pivot: fewer domains now use Cloudflare, and the malware’s operators have diversified their infrastructure across multiple service providers to reduce detection risk.
Post-takedown campaigns and delivery innovations
Recent campaigns have leveraged deceptive delivery methods, including fake tools and the ClickFix technique.
ClickFix in focus: Tracking the evolution of this social engineering tactic
ClickFix continues to gain traction as a preferred delivery method for malware, used by both cybercriminals and state-sponsored actors. Tanium’s CTI team has been closely monitoring its evolution across multiple campaigns. Here are some of the latest insights:
• Rogue Tools, ClickFix, and BlueNoroff (Published June 25, 2025): CTI explores a surge in ClickFix campaigns involving GHOSTPULSE malware, noting how the technique is being adopted by nation-state actors from North Korea, Iran, and Russia.
• Deepfakes, ToyMaker IAB, and ClickFix (Published April 30, 2025): CTI details how attackers are using ClickFix to deliver a modified Havoc Demon agent, emphasizing the technique’s reliance on user interaction and its growing popularity.
• Silk Typhoon, Fake Ransom Notes, and ClickFix (Published March 12, 2025): This roundup highlights a ClickFix-style phishing campaign that leverages SharePoint and Microsoft Graph API to stealthily deploy a modified Havoc Demon agent.
Lumma Stealer has also been distributed via GitHub repositories and social media platforms—highlighting its operators’ agility in exploiting trusted channels for malware propagation.
Analyst comments from Tanium’s Cyber Threat Intelligence team
The return of Lumma Stealer underscores the determination of threat actors and their ability to continuously evolve their tactics to bypass modern defenses.
Lumma Stealer isn’t the only group to return after being taken down. It serves as a reminder that while law enforcement efforts may significantly disrupt operations, they don’t always eliminate the threat.
As Trend Micro points out, the operators behind the malware “pose a continued risk to organizations and individuals worldwide.” Security awareness training is critical in addition to technical defenses.
NailoLocker Cheese: A sophisticated threat to Windows systems with built-in decryption
Fortinet researchers have identified NailaoLocker, a Windows-targeting ransomware variant nicknamed “Cheese.” What sets it apart is its use of hard-coded SM2 cryptographic keys and a built-in decryption function—an unusual combination that raises questions about its true intent. Could this be a rare opportunity for recovery, or a trap designed to mislead victims and researchers?
Stealthy delivery via DLL side-loading
NailaoLocker arrives as a trio of files:
- A legitimate executable (
usysdiag.exe) used for DLL side-loading - A malicious loader DLL (
sensapi.dll) - The obfuscated ransomware payload (
usysdiag.exe.dat)
Execution begins when the attacker launches the legitimate executable, which loads the malicious DLL and decrypts the payload directly into memory. To minimize forensic traces, the loader frees its own memory and deletes the DLL post-execution.
Mode switching and initialization behavior
The ransomware determines whether to run in encryption or decryption mode by comparing a hard-coded value to a specific string (“XXXX”). This switch appears to be internal, as NailaoLocker does not support command-line arguments for mode selection.
During initialization, it launches a console window for real-time status updates and creates a log file (lock.log) to track progress—indicating no intent to conceal its activity.
Multi-threaded encryption with SM2 key pairs
NailaoLocker uses a multi-threaded architecture to maximize throughput across processor cores. It encrypts files using AES-256-CBC and appends “.locked” to affected files, also setting them as hidden. The ransomware’s use of hard-coded SM2 key pairs—embedded in ASN.1 DER format—is a distinctive feature that enables both encryption and decryption routines.
Decryption mode: A built-in recovery path?
In decryption mode, NailaoLocker scans directories for encrypted files and attempts to restore them using the embedded SM2 private key. While this functionality could offer a recovery path, Fortinet cautions that it may also serve as a decoy or internal testing feature.
Analyst comments from Tanium’s Cyber Threat Intelligence team
NailaoLocker’s decryption function is highly unusual and could suggest either a developer backdoor or simply a tactic to confuse both analysts and victims.
If security researchers figure out how to reliably trigger the decryption mode, this ransomware could ironically become a case study in how attacker mistakes can be turned into wins for defenders.
This ransomware variant is also unique in its use of an embedded SM2 key pair, which Fortinet believes may still be in development.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.