The malware often hides behind fake CAPTCHAs and has been used to commit financial fraud. Microsoft took down 2,300 domains that ran it and updated Defender to identify it.

Microsoft and law enforcement have announced a court-authorized takedown of Lumma, a prolific info-stealer malware operation found on more than 394,000 Windows PCs globally, mostly in Brazil, Europe, and the United States.

Microsoft said it identified over 394,000 Windows computers were infected by the Lumma malware March 16-May 16.