Stealth in Motion – How Lumma Affiliates Leverage Evasion Tools for Uninterrupted Operations

A comprehensive investigation by Recorded Future’s Insikt Group has unveiled the sophisticated evasion arsenal employed by Lumma Stealer affiliates, revealing a multi-layered approach to maintaining operational security that has kept the notorious information-stealing malware thriving despite law enforcement pressure.

The analysis,

spanning twelve months from mid-2024 to mid-2025, exposes how Lumma affiliates utilize an interconnected ecosystem of privacy-enhancing services, anti-detection browsers, and specialized tools to evade detection and ensure business continuity.

Despite facing significant law enforcement actions in May 2025, Lumma’s resilience stems from this decentralized operational model that makes disruption efforts largely ineffective in the long term.

Anti-Detection Browsers Enable Multi-Account Operations

At the core of Lumma affiliates’ stealth capabilities are specialized anti-detection browsers designed for managing multiple fraudulent accounts without triggering security measures. 

Dolphin (dolphin-anty.com) emerged as the most prevalent tool, recognized as one of the premier anti-detect browsers for multi-account management operations.

Octo Browser (octobrowser.net) also shows high adoption rates among affiliates, providing advanced fingerprint masking that complicates attribution efforts by law enforcement and threat intelligence professionals.

The browsers enable affiliates to maintain distinct digital identities while simultaneously operating rental scams, credential validation operations, and other fraudulent activities.

Even privacy-focused browsers like Brave have found favor among affiliates due to their robust built-in security features, including aggressive ad and tracker blocking capabilities that provide baseline anonymity protection.

Proxy Networks and VPN Layering Create Attribution Challenges

Lumma affiliates employ sophisticated proxy networks to mask their actual locations and identities. PIA Proxy and GhostSocks represent the most frequently observed services, with GhostSocks forming a notable partnership with Lumma operators in early 2024.

The GhostSocks collaboration allows affiliates to create SOCKS5 proxies directly from infected victim machines, enabling attacks that appear to originate from legitimate user devices.

By 2025, this expanded to include backconnect proxy access to compromised systems, significantly improving bypass capabilities against access controls like Google’s cookie-based protections.

Traditional VPN services, including ExpressVPN, NordVPN, ProtonVPN, Surfshark, and TunnelBear, provide additional layers of anonymization, with investigators noting that all analyzed affiliates utilized multiple VPN providers simultaneously.

Detection Evasion Through Specialized Testing Services

Following the law enforcement seizure of AVCheck in May 2025, affiliates rapidly pivoted to alternative malware scanning services like KleenScan (kleenscan.com).

These platforms allow threat actors to test malicious payloads against multiple antivirus engines while maintaining a strict “No Distribution” policy that prevents samples from reaching security vendors.

The Hector crypting service (hector.su) provides fully undetectable (FUD) droppers and document exploits, with recent offerings boasting “0/26 detections” on antivirus scans and Gmail attachment compatibility.

This outsourcing of complex evasion techniques demonstrates the collaborative nature of the Lumma ecosystem.

The investigation reveals that Lumma’s affiliate network operates as a sophisticated, decentralized criminal enterprise where individual disruptions produce only temporary setbacks.

The rapid adoption of alternative services following law enforcement actions underscores the adaptability and resilience of this threat landscape.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates

The post Stealth in Motion – How Lumma Affiliates Leverage Evasion Tools for Uninterrupted Operations appeared first on Cyber Security News.