Lumma Stealer malware hides in a fake Telegram Premium site, launching without user clicks

• Lumma Stealer malware hides in a fake Telegram Premium site, launching without user clicks
• Executable uses cryptor obfuscation to bypass most traditional antivirus scanning techniques entirely
• Malware connects to real Telegram servers while secretly sending stolen data to hidden domains

A malicious campaign is targeting users through a fraudulent Telegram Premium website, delivering a dangerous variant of the Lumma Stealer malware.

A report from Cyfirma claims the domain telegrampremium[.]app closely mimics the legitimate Telegram Premium brand and hosts a file named start.exe.

This executable, built in C/C++, is automatically downloaded upon visiting the site, requiring no user interaction.

A ...