New Malware Campaign Uses Cracked Software to Spread Lumma and ACR Stealer: Threat Analysis and Legal Recourse in India

A sophisticated malware distribution campaign has recently been observed distributing high-risk infostealers—specifically Lumma Stealer (LummaC2) and the emerging ACR Stealer—by masquerading malicious payloads as cracked commercial software, game patches, and productivity utilities. For individual users and businesses in India, where unauthorized software downloads remain widespread due to high licensing costs, this campaign poses an acute cybersecurity and legal threat.

When a workstation is compromised, these infostealers exfiltrate saved browser passwords, session cookies, cryptocurrency wallets, and confidential corporate data within seconds. This article examines the mechanics of this malware wave, the applicable provisions under the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita (BNS), 2023, and practical steps for filing an official cyber complaint in the Mumbai Metropolitan Region.

Understanding the Threat: Lumma and ACR Stealers

Infostealers operate on a Malware-as-a-Service (MaaS) business model, allowing cybercriminals to buy ready-made payloads and backend command-and-control (C2) infrastructure.

1. Delivery via Cracked Software

Threat actors exploit search engine optimization (SEO) poisoning, malicious torrent trackers, and fake software repositories. Users searching for cracked versions of video editors, design suites, PDF converters, or system utilities are directed to landing pages hosting archive files (often ZIP or RAR, password-protected to evade perimeter antivirus scanners). Inside, alongside or embedded within the executable setup, lies the loader script.

2. Capabilities of Lumma Stealer

LummaC2 is written in C and constantly updated to evade detection. Once executed, it:

Infiltrates Chromium- and Gecko-based web browsers (Chrome, Edge, Firefox, Brave).
Extracts stored credentials, credit card records, and autofill entries.
Harvests active session tokens and cookies, enabling attackers to bypass two-factor authentication (2FA) via session hijacking without needing the victim's phone or authenticator app.
Targets cryptocurrency browser extensions, desktop cold-wallet apps, and two-factor authentication desktop clients.

3. The Rise of ACR Stealer

ACR Stealer has surfaced as a lightweight, modular alternative. Distributed through similar pirated software vectors, it systematically scans local directories for sensitive configuration files, documents containing keywords like "password", "ledger", or "confidential", and browser history. It communicates with encrypted C2 servers, exfiltrating the gathered data in zipped archives before attempting to delete its own staging files.

The Real-World Risk for Indian MSMEs and Professionals

Many micro, small, and medium enterprises (MSMEs) and independent professionals operating across Mumbai, Thane, and Navi Mumbai permit employees to use personal devices or deploy unverified software tools to reduce overheads.

When a device running cracked software connects to an enterprise network, the impact can be severe:

Corporate Network Infiltration: Extracted remote desktop (RDP) credentials or VPN access tokens allow attackers to pivot deeper into internal servers.
Financial Fraud: Hijacked banking sessions permit unauthorized automated clearing house (ACH) transactions, NEFT/RTGS debits, or UPI fraud.
Client Confidentiality Breaches: Unauthorized exfiltration of customer records, intellectual property, or confidential trade secrets creates civil liabilities and regulatory compliance issues.

Indian Legal Framework: IT Act, 2000 and Bharatiya Nyaya Sanhita, 2023

Victims of malware attacks often assume that because malware operates anonymously on the internet, the Indian legal system provides no recourse. To the contrary, the law criminalizes both the distribution of malicious code and the resulting unauthorized data extraction.

1. Information Technology Act, 2000 (IT Act)

Section 43: Imposes civil liability and statutory compensation for unauthorized access, downloading or copying data, introducing computer contaminants or computer viruses, and damaging computer systems.
Section 66 (Computer Related Offences): Treats any dishonest or fraudulent act under Section 43 as a cognizable criminal offence, punishable with imprisonment of up to three years or a fine of up to five lakh rupees, or both.
Section 66C (Identity Theft): Directly applies to infostealers that harvest passwords, digital signatures, or electronic session tokens. It prescribes imprisonment of up to three years and a fine.
Section 66D (Cheating by Personation Using Computer Resource): Applies when stolen session cookies or credentials are used by an intruder to impersonate the victim and authorize banking transfers or email communications.

2. Bharatiya Nyaya Sanhita, 2023 (BNS)

Following the criminal law reforms that took effect on July 1, 2024, replacing the Indian Penal Code (IPC), several provisions of the BNS apply to cyber intrusion:

Section 318 of BNS (Cheating): Pertains to fraudulent deception and inducement, applicable where cracked software links fraudulently trick a user into executing malicious code.
Section 336 & Section 338 of BNS (Forgery and Forged Electronic Records): Covers the fabrication of deceptive software wrappers and falsified certificates designed to bypass security prompts.
Section 303 of BNS (Theft): Pertains to theft of movable property, reading harmoniously with technological provisions where intangible commercial data or financial assets are siphoned.

Immediate Technical and Incident Response Steps

If you or an employee has executed a file from an unverified source and suspect an infostealer infection:

Disconnect from the Network: Immediately unplug Ethernet cables and disconnect from Wi-Fi to stop ongoing exfiltration to the attacker's C2 server.
Terminate Active Web Sessions from an Uncompromised Device: Using a separate, clean smartphone or computer, log into critical accounts (email, net-banking, corporate portals) and select "Sign out of all sessions/devices".
Change All Credentials & Reset 2FA: Update passwords and regenerate 2FA seeds for banking, primary emails, cloud services, and crypto exchanges.
Preserve Forensic Evidence: Do not immediately format the hard drive. Take photographs or screenshots of suspicious processes, error dialogues, downloaded files, and browser download logs. This evidence is vital for legal proceedings and police investigations.

How to Report Cybercrime in Mumbai, Thane, and Mira Road

Victims of cyber attacks in the Mumbai Metropolitan Region have formal avenues for regulatory and criminal redress:

1. National Cyber Crime Reporting Portal (NCRP)

File an initial complaint at cybercrime.gov.in or call the National Cyber Helpline at 1930. This is critical if funds have been siphoned from a bank account, as the 1930 system communicates directly with beneficiary banks to freeze stolen amounts.

2. Local Cyber Police Stations in Mumbai and Thane

Under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) (which replaced Section 154 of the CrPC), police are mandated to record information regarding cognizable offences:

Mumbai Police Cyber Cell: Operating regional cyber police stations in Bandra-Kurla Complex (BKC), South Region (Worli), East Region, North Region, and West Region.
Thane Commissionerate Cyber Cell: Located at the Police Commissioner’s Office, Thane (West).
Mira-Bhayandar Vasai-Virar (MBVV) Cyber Cell: Catering to residents and businesses in Mira Road, Bhayandar, and adjacent jurisdictions.

When visiting the cyber cell, bring a written complaint detailing the timeline, printouts of suspicious file hashes/names, bank account statements (showing unauthorized debits), and relevant server or email access logs.

Frequently Asked Questions (FAQs)

Can an individual be held legally liable if pirated software on their PC infects their employer's network?

Yes. An employee who introduces unapproved, cracked software onto corporate hardware may be subjected to internal disciplinary action, termination for gross negligence, and potentially civil claims under Section 43 of the IT Act for causing unauthorized contamination of corporate systems.

Is downloading cracked software itself an offence in India?

Downloading and using cracked software infringes the intellectual property rights of the software publisher under the Copyright Act, 1957 (Section 63 provides for penalties including imprisonment). Furthermore, running cracks that alter copyright management details can attract separate legal exposure.

How does the Adjudicating Officer under the IT Act help malware victims?

Under Section 46 of the IT Act, the Secretary of the State IT Department acts as the Adjudicating Officer. Victims who have suffered financial losses or data contamination due to cyber contraventions can petition the Adjudicating Officer for civil compensation against wrongdoers or negligent parties, independent of criminal police proceedings.

What should a business do if confidential client data was stolen by Lumma Stealer?

Apart from isolating devices and filing an FIR, Indian entities must assess their reporting obligations under CERT-In (Indian Computer Emergency Response Team) directives, which mandate the reporting of specified cybersecurity incidents within six hours of identification.

Safeguard Your Legal Rights with APS Law

Data theft, identity compromise, and financial cyber frauds require swift technical mitigation and strategic legal intervention. Whether you are dealing with unauthorized system breaches, internal compliance challenges, or need assistance drafting formal police complaints and petitions before the IT Adjudicating Officer, APS Law provides dedicated cyber-law counsel across Mumbai, Thane, and Mira Road.

Contact APS Law today to schedule an initial legal consultation for your cyber and regulatory matters.