Leuma Stellar: The Malware That Wants Your Crypto and Thinks You’re Dumb Enough to Hand It Over

11 Mar

Crypto Bro? Business Owner? Both? Either Way — You’re a Target

Imagine you’re minding your own business, maybe checking your crypto balance or downloading an innocent-looking PDF attachment that claims it’s from a “bot detection system.” Sounds weird, right? Well, congratulations — you’ve just met Leuma Stellar, the malware that specialises in draining your wallets, stealing your logins, and making your entire day worse.

This delightful piece of digital thievery isn’t picky. Whether you’re a wannabe Bitcoin billionaire, a finance director at an SME, or just some unlucky sod who clicked the wrong link, Leuma Stellar is perfectly happy to rob you blind.

What is Leuma Stellar?

It’s not a DJ. It’s not a new crypto coin. It’s malware built specifically to steal your crypto wallets, browser data, and login credentials. In short, it’s a professional bastard.

It spreads through phishing emails carrying malicious PDFs. These files pretend to be helpful little "bot detection system images." Except instead of detecting bots, they deploy malware into your system faster than you can say ‘what the fuck just happened.’

How It Works – Step by Stupid Step

You get an email with a PDF attachment that looks vaguely legit — perhaps pretending to be a compliance form or an automated security check.
You open it. (Because why not? What could possibly go wrong?)
The malware executes silently in the background. Your system doesn’t even burp.
Leuma Stellar quietly vacuums up:
- Your browser cookies (say goodbye to saved logins)
- Your cryptocurrency wallet data (including private keys)
- Other useful tidbits like session tokens and autofill data
All that loot gets sent back to a remote server where the attackers gleefully prepare to empty your accounts or sell your credentials to the highest bidder.

Who’s Affected?

At first, this malware did the rounds in Pakistan, prompting an official warning from the Pakistan Cyber Emergency Response Team (PKCERT). But cybercrime is a global sport, and it’s already popped up in Europe, North America, and everywhere people are silly enough to believe PDFs can detect bots.

Let me be clear: this is not a Pakistan problem, this is a ‘humans are easily fooled by shiny things’ problem. If you or your team handles crypto, financial data, or sensitive logins, you’re a target.

The Real WTF Moment – PDF Bot Detection? Seriously?

Let’s pause and appreciate the sheer audacity of this. They didn’t even bother with fake invoices or fake LinkedIn invites. They literally packaged malware inside a PDF and called it a bot detection system image. That’s like disguising a burglary kit as a vacuum cleaner and hoping nobody notices when the windows start smashing.

Yet it works — because most people:

Don’t question attachments.
Assume anything mentioning “security” must be real.
Love clicking things without thinking.

What Happens Next?

If Leuma Stellar hits you, expect:

Your crypto wallets emptied faster than you can pronounce ‘decentralised ledger.’
Your passwords turned into commodities on some dodgy hacker forum.
Your IT team wondering why your entire browser history is being auctioned off.

If you run a business that accepts crypto payments or holds customer financial data, you might also find yourself explaining to customers, insurers, and regulators why you’re incompetent enough to get owned by a fake bot detection PDF.

What You Should Have Done (And What You Need to Do Now)

1. Stop Clicking Shit.

I cannot stress this enough. Unsolicited PDFs are the herpes of email attachments. Unless you specifically asked for it — do not open it.

2. Enable 2FA Everywhere.

Because if they get your passwords, at least you can still throw a spanner in the works with a second factor. Use app-based 2FA, not SMS (because if you’re still using SMS for 2FA in 2025, you deserve a stern talking-to).

3. Lock Down Crypto Wallets.

Use hardware wallets for anything worth real money.
Don’t store private keys anywhere your browser can find them.
Don’t let random PDFs anywhere near your crypto setup.

4. Educate Your Team.

Everyone in your business — from the receptionist to the CEO — needs to know that “bot detection PDFs” are not a thing. If they see something that daft, they should either delete it or frame it for the office wall of shame.

5. Invest in Proper Email Security.

You know those fancy email gateways that scan attachments before delivery? This is why you need one. Because left to their own devices, humans will absolutely click themselves into disaster.

Time to Audit Your Defences

If you’re reading this and thinking, “Shit, do we even check our attachments?”, you’ve got work to do.
✅ Review your email security policies.
✅ Run some phishing simulations to see who falls for what.
✅ Get proper endpoint detection that actually spots malware like this.

Or just carry on, and we’ll see you on the next dark web credentials dump.

Source	Description	Link
PKCERT	Official advisory on Leuma Stellar	PKCERT Website
HackRead	Analysis of Leuma Stellar and its spread	HackRead Article
ANY.RUN	Technical breakdown of Leuma Stellar’s behaviour	ANY.RUN Analysis
Qualys	Deep dive into Leuma Stellar’s fake CAPTCHA scam	Qualys Blog
Darktrace	Overview of the rise of info-stealers like Leuma	Darktrace Blog

Noel Bradford

Noel Bradford – Head of Technology at Equate Group, Professional Bullshit Detector, and Full-Time IT Cynic

As Head of Technology at Equate Group, my job description is technically “keeping the lights on,” but in reality, it’s more like “stopping people from setting their own house on fire.” With over 40 years in tech, I’ve seen every IT horror story imaginable—most of them self-inflicted by people who think cybersecurity is just installing antivirus and praying to Saint Norton.

I specialise in cybersecurity for UK businesses, which usually means explaining the difference between ‘MFA’ and ‘WTF’ to directors who still write their passwords on Post-it notes. On Tuesdays, I also help further education colleges navigate Cyber Essentials certification, a process so unnecessarily painful it makes root canal surgery look fun.

My natural habitat? Server rooms held together with zip ties and misplaced optimism, where every cable run is a “temporary fix” from 2012. My mortal enemies? Unmanaged switches, backups that only exist in someone’s imagination, and users who think clicking “Enable Macros” is just fine because it makes the spreadsheet work.

I’m blunt, sarcastic, and genuinely allergic to bullshit. If you want gentle hand-holding and reassuring corporate waffle, you’re in the wrong place. If you want someone who’ll fix your IT, tell you exactly why it broke, and throw in some unsolicited life advice, I’m your man.

Technology isn’t hard. People make it hard. And they make me drink.

https://noelbradford.com