News report

# Lumma infostealer malware returns after law enforcement disruption

BleepingComputer, July 22, 2025. Lumma Stealer's resurgence after the May 2025 law-enforcement disruption: infrastructure began ramping up again within weeks of the takedown..

**Source type:** News report

**Published:** July 22, 2025

**Research grade:** S1

**Used in entries:** 1

## Bibliographic record

**Publisher:** BleepingComputer

**Published:** July 22, 2025

**Source type:** News report

**Research grade:** Source grade S1

**Language:** English

**Official record:** Not an official publication

**Address:** [https://www.bleepingcomputer.com/news/security/lumma-infostealer-malware-returns-after-law-enforcement-disruption/](https://www.bleepingcomputer.com/news/security/lumma-infostealer-malware-returns-after-law-enforcement-disruption/)

**What it supports:** Lumma Stealer's resurgence after the May 2025 law-enforcement disruption: infrastructure began ramping up again within weeks of the takedown.

**Dataset id:** src\_bleepingcomputer\_lumma\_returns\_2025

## Research notes

- By Bill Toulas.
- The article gives no calendar first-seen date, only 'within weeks of the takedown', so it cannot pin an exact first\_seen\_on.

How this source is used

Cited 1 time across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Later activity

1 citation

Cited for activity recorded after the takedown.

-
[Lumma Stealer rebound](https://takedownindex.org/takedowns/lumma-stealer-disruption)

Same service on replacement infrastructure, Lumma Stealer disruption

Later outcome

[All sources](https://takedownindex.org/sources)