Lumma Infostealer the most prevalent malware in 2025Modern email and document-driven attack chains have evolved beyond single exploits. Today’s threats prioritize reliable delivery mechanisms combined with rapid credential harvesting and readily available loaders or remote access tools. The dominant outcomes fall into two categories: credential-stealing malware and commodity remote access tools, typically deployed through lightweight loaders and system-native execution methods.

Credential-Focused Infostealers

Lumma Stealer (LummaC/LummaC2)

Prevalence in 2025: Microsoft identifies Lumma as the most frequently encountered infostealer throughout the reporting window spanning mid-2024 through mid-2025.

Delivery Chain: The attack typically begins with a phishing email containing either a malicious attachment or link. This leads victims to a weaponized Office document utilizing macros or exploits, or alternatively, a PDF that redirects to a download location. A compact loader then executes through PowerShell, Windows Installer, or script interpreters, retrieving the Lumma payload.

Primary Capabilities: Lumma specializes in extracting browser credentials, session tokens, cookies, and application data including cryptocurrency wallet information.

Detection Indicators

  • Swift browser data collection and packaging, frequently compressed or obfuscated
  • Evasion techniques including string obfuscation, control-flow manipulation, and sandbox detection
  • Data exfiltration over encrypted channels or through commodity command-and-control infrastructure

StealC, Vidar & Rhadamanthys

These variants continue appearing as secondary payloads following document-based initial access. Industry analysis consistently positions infostealers as central to credential-driven cybercrime operations in 2025.

Technical Characteristics

  • Extraction from browser storage and session data (enabling MFA bypass through session hijacking)
  • Defense circumvention via packing, obfuscation, and scripted execution sequences
  • Malware-as-a-Service distribution model creates wide variation in infrastructure and techniques across affiliates

Remote Access Tools & Keyloggers

AsyncRAT maintains its position across multiple threat intelligence indices as a prevalent commodity RAT, frequently delivered via phishing and deployed through intermediate infrastructure.

Operational Capabilities

  • Remote command execution and file system operations
  • Persistence establishment and additional tool deployment
  • Typically staged through loaders rather than direct attachment delivery

Agent Tesla

This spyware remains a frequent payload in email-driven attacks, commonly associated with malicious documents and older Office vulnerability exploitation.

Core Functions

  • Keystroke logging and clipboard monitoring
  • Credential harvesting from browsers, email clients, and FTP applications
  • Exfiltration via SMTP, HTTP, or custom control panels depending on variant

NetSupport RAT

An emerging 2025 trend involves weaponizing legitimate remote administration software. NetSupport Manager appears regularly in incident response documentation as a representative example.

Operational Approach

  • Masquerades as legitimate software, complicating security policy enforcement
  • Enables interactive system control, payload deployment, and lateral movement within smaller networks

Delivery Mechanisms & Loaders

SocGholish (FakeUpdates)

Though primarily web-based, SocGholish connects to document campaigns through PDF and Office lures that redirect users to fraudulent update pages. Government reporting positions SocGholish among leading malware families, frequently serving as a gateway to RAT deployment.

QuirkyLoader

Recent intelligence describes QuirkyLoader distributing payloads including Agent Tesla and AsyncRAT, exemplifying the email-to-loader-to-payload progression.

PowerShell Shellcode Loaders

In-memory PowerShell execution remains prevalent for staging RATs while minimizing forensic artifacts—a common goal in document-initiated attack sequences.

Document Execution Techniques in 2025

Office Documents

Attackers in 2025 continue employing:

  • Social engineering combined with macro/script activation (the most dependable approach)
  • Legacy vulnerability exploitation (such as Equation Editor CVE-2017-11882) to reduce user interaction requirements on unpatched systems

PDF Documents

Modern PDF campaigns function primarily as sophisticated social engineering operations. They employ invoice or notification themes, embedded links or QR codes, and prompts designed to direct users toward downloading secondary payloads or submitting credentials to phishing sites.

How FileDNA CADR breaks the malicious files delivery step: Detection-based defenses ask a fragile question, “have I seen this before?” That question fails against a brand-new N-hour exploit with no signature and no reputation history. CADR asks a fundamentally different question, “what is the known-good version of this file?” FileDNA analyzes each inbound file, disarms active and executable content, and reconstructs a clean, structurally valid version that preserves the legitimate content the user needs while discarding everything that does not belong. There is no waiting for a signature, no reliance on prior knowledge of the exploit, and no dependence on the endpoint having been patched. A weaponized document is neutralized during reconstruction at the ingress boundary, before the freshly minted exploit inside it ever gets the chance to fire.