News report

# Lumma infostealer's infrastructure seized during US, EU, Microsoft operation

The Record (Recorded Future News), May 21, 2025. Establishes that Lumma operators stood up three replacement domains within roughly a day of the initial May 2025 seizure, which DOJ/Microsoft subsequently also seized..

**Source type:** News report

**Published:** May 21, 2025

**Research grade:** S1

**Used in entries:** 2

## Bibliographic record

**Publisher:** The Record (Recorded Future News)

**Published:** May 21, 2025

**Source type:** News report

**Research grade:** Source grade S1

**Language:** English

**Official record:** Not an official publication

**Address:** [https://therecord.media/lumma-infostealer-malware-takedown-microsoft-fbi](https://therecord.media/lumma-infostealer-malware-takedown-microsoft-fbi)

**What it supports:** Establishes that Lumma operators stood up three replacement domains within roughly a day of the initial May 2025 seizure, which DOJ/Microsoft subsequently also seized.

**Dataset id:** src\_doj\_lumma\_rebound\_2025

## Research notes

- No exact URL for this original source stub was recovered in the audit. The linked replacement source(s) support the material claim; no URL was invented.

How this source is used

Cited 2 times across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Later activity

2 citations

Cited for activity recorded after the takedown.

-
[Lumma Stealer rebound](https://takedownindex.org/takedowns/lumma-stealer-disruption)

Same service on replacement infrastructure, Lumma Stealer disruption

Supporting source
-
[Lumma replacement domains (3 domains, seized same wave)](https://takedownindex.org/takedowns/lumma-stealer-disruption)

Same operators, Lumma Stealer disruption

Supporting source

[All sources](https://takedownindex.org/sources)