Lunar Stealer Fake Windows 11 Installer Activity

Tim Peck@timpeck

•updated Feb 20, 2026•4•0•40

Detects behavioral indicators associated with a malware campaign distributing a credential and crypto-wallet stealer disguised as a Windows 11 update. Detection is based on TTPs rather than IOCs for longevity: suspicious directory creation, obfuscated PowerShell execution, and registry-based persistence.