Fake 'Snapchat Mod APK' Site Serves Hash-Rotating LummaStealer
A Cloudflare-fronted domain promising a Snapchat mod APK instead delivers Windows stealer binaries and a delayed-execution VBScript stager. Two of three LummaStealer builds share an identical import hash despite months apart, while all three exfiltrate through Telegram's own API.
A domain built around the promise of a "Snapchat mod APK" — the kind of search-bait a mobile user might stumble into while hunting pirated app modifications — is instead handing out Windows desktop executables and batch scripts. thesnapchatmodapk.com, registered on 2025-04-11 and still resolving behind Cloudflare more than a year later, hosts a file list of update1.exe, update2.exe, update3.exe, mine.bat and wdd.bat. None of those are mobile artifacts.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read