{"id":253,"date":"2026-08-20T14:57:42","date_gmt":"2026-08-20T18:57:42","guid":{"rendered":"https:\/\/securebydefault.io\/blog\/?p=253"},"modified":"2026-08-21T06:49:25","modified_gmt":"2026-08-21T10:49:25","slug":"soc338-lumma-stealer-dll-side-loading-clickfix-phishing","status":"publish","type":"post","link":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/","title":{"rendered":"SOC338 LetsDefend Walkthrough: Lumma Stealer via DLL Side-Loading (ClickFix Phishing)"},"content":{"rendered":"\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"720\" height=\"376\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/LDefend.jpg\" alt=\"\" class=\"wp-image-254\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/LDefend.jpg 720w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/LDefend-300x157.jpg 300w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This is a walkthrough of LetsDefend SOC338, a Critical severity phishing alert involving Lumma Stealer and ClickFix. If you are practicing for a SOC analyst role or working through LetsDefend alerts, here is exactly how I approached the investigation step by step.<\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-1 wp-block-paragraph\"><strong>Alert Details<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<style>\n.alert-table { width: 100%; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; border: 1px solid #d1d5db; border-radius: 8px; overflow: hidden; }\n.alert-table td { padding: 10px 14px; border-bottom: 1px solid #e5e7eb; vertical-align: middle; }\n.alert-table tr:last-child td { border-bottom: none; }\n.alert-table .label { font-weight: 600; width: 160px; color: #7C3AED; background: #F5F3FF; }\n.alert-table .value { color: #1f2937; background: #ffffff; }\n.badge-red { display: inline-block; background: #FEE2E2; color: #991B1B; font-weight: 600; font-size: 12px; padding: 2px 10px; border-radius: 20px; }\n.badge-purple { display: inline-block; background: #EDE9FE; color: #6D28D9; font-weight: 600; font-size: 12px; padding: 2px 10px; border-radius: 20px; }\n.badge-green { display: inline-block; background: #D1FAE5; color: #065F46; font-weight: 600; font-size: 12px; padding: 2px 10px; border-radius: 20px; }\n<\/style>\n\n<table class=\"alert-table\">\n  <tr>\n    <td class=\"label\">Event ID<\/td>\n    <td class=\"value\">316<\/td>\n  <\/tr>\n  <tr>\n    <td class=\"label\">Severity<\/td>\n    <td class=\"value\"><span class=\"badge-red\">Critical<\/span><\/td>\n  <\/tr>\n  <tr>\n    <td class=\"label\">Type<\/td>\n    <td class=\"value\"><span class=\"badge-purple\">Data Leakage<\/span><\/td>\n  <\/tr>\n  <tr>\n    <td class=\"label\">Rule Name<\/td>\n    <td class=\"value\">SOC338 &#8211; Lumma Stealer &#8211; DLL Side-Loading via ClickFix Phishing<\/td>\n  <\/tr>\n  <tr>\n    <td class=\"label\">Verdict<\/td>\n    <td class=\"value\"><span class=\"badge-green\">True Positive<\/span><\/td>\n  <\/tr>\n<\/table>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-2 wp-block-paragraph\">Overview<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Someone decided the best way to steal credentials was to disguise malware as a Windows update.  Spoiler, it did not work.  Here is how the investigation went.<\/p>\n\n\n\n<style>\n.callout { border-radius: 4px; padding: 14px 16px; margin-bottom: 16px; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.6; }\n.callout-title { font-weight: 700; margin-bottom: 6px; }\n.callout-purple { background: #F5F3FF; border-left: 4px solid #7C3AED; }\n.callout-purple .callout-title { color: #7C3AED; }\n.callout-purple p { color: #1f2937; margin: 0; }\n.callout-amber { background: #FFFBEB; border-left: 4px solid #D97706; }\n.callout-amber .callout-title { color: #D97706; }\n.callout-amber p { color: #1f2937; margin: 0; }\n<\/style>\n\n<div class=\"callout callout-purple\">\n  <div class=\"callout-title\">What is Lumma Stealer?<\/div>\n  <p>Lumma Stealer is an information-stealing malware that targets credentials stored in browsers, cryptocurrency wallets, and two-factor authentication applications. It uses DLL side-loading to execute by hijacking a legitimate process, making it harder for endpoint security tools to catch. It is delivered here via a ClickFix phishing lure.<\/p>\n<\/div>\n\n<div class=\"callout callout-amber\">\n  <div class=\"callout-title\">What is ClickFix?<\/div>\n  <p>ClickFix is a social engineering technique that presents the victim with a fake error message or system prompt and instructs them to click a button or run a command to fix the problem. In this case the lure was a fake Windows 11 upgrade prompt. The same technique gets used with fake CAPTCHA prompts, fake browser errors, and fake software license pop-ups. It works because it exploits the user&#8217;s instinct to fix something that appears broken.<\/p>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-3 wp-block-paragraph\">Step 1: Case Initialization<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">The alert came in through the Investigate Channel in the Monitoring section.  The first step was taking ownership of EventID 316 and creating a case ticket to kick off the formal investigation. <\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"631\" height=\"453\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Take-Ownership-v2.png\" alt=\"\" class=\"wp-image-257\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Take-Ownership-v2.png 631w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Take-Ownership-v2-300x215.png 300w\" sizes=\"auto, (max-width: 631px) 100vw, 631px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"627\" height=\"464\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/create-ticket.png\" alt=\"\" class=\"wp-image-258\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/create-ticket.png 627w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/create-ticket-300x222.png 300w\" sizes=\"auto, (max-width: 627px) 100vw, 627px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">With the case created, the next step was opening the playbook, which is a structured checklist that walks through every step of the analysis so nothing gets missed and the response stays consistent regardless of who handles the alert.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"248\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Start-playbook-1-1024x248.png\" alt=\"\" class=\"wp-image-260\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Start-playbook-1-1024x248.png 1024w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Start-playbook-1-300x73.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Start-playbook-1-764x185.png 764w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Start-playbook-1.png 1367w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<style>\n.callout { border-radius: 4px; padding: 14px 16px; margin-bottom: 16px; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.6; }\n.callout-title { font-weight: 700; margin-bottom: 6px; }\n.callout-purple { background: #cffafe; border-left: 4px solid #0e7490; }\n.callout-purple .callout-title { color: #0e7490; }\n.callout-purple p { color: #1f2937; margin: 0; }\n<\/style>\n\n<div class=\"callout callout-purple\">\n  <div class=\"callout-title\">Tip<\/div>\n  <p>Duplicate the browser tab so you can keep the playbook visible on one side while working through the alert details on the other. Small thing, real time saver.<\/p>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-4 wp-block-paragraph\">Step 2: Analyze the Phishing Email<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">The playbook starts with the phishing email itself.  This one had red flags stacked on red flags.<\/p>\n\n\n\n<style>\n.meta-section { font-family: Arial, sans-serif; font-size: 14px; margin-bottom: 20px; }\n.meta-section h3 { font-size: 15px; font-weight: 700; color: #1f2937; margin: 0 0 8px 0; }\n.meta-table { width: 100%; border-collapse: collapse; border: 1px solid #d1d5db; }\n.meta-table td { padding: 9px 14px; border-bottom: 1px solid #e5e7eb; vertical-align: middle; }\n.meta-table tr:last-child td { border-bottom: none; }\n.meta-table .label { font-weight: 600; width: 160px; color: #374151; background: #F9FAFB; border-right: 1px solid #e5e7eb; }\n.meta-table .value { color: #1f2937; background: #ffffff; }\n.meta-table .label-red { font-weight: 600; width: 160px; color: #991B1B; background: #FEF2F2; border-right: 1px solid #fecaca; }\n.meta-table .value-red { color: #1f2937; background: #FEF2F2; }\n<\/style>\n\n<div class=\"meta-section\">\n  <h3>Email Metadata<\/h3>\n  <table class=\"meta-table\">\n    <tbody><tr>\n      <td class=\"label\">Event Time<\/td>\n      <td class=\"value\">2025-03-13 at 02:44:30<\/td>\n    <\/tr>\n    <tr>\n      <td class=\"label\">SMTP Address<\/td>\n      <td class=\"value\">132.232.40.201<\/td>\n    <\/tr>\n    <tr>\n      <td class=\"label-red\">Sender Domain<\/td>\n      <td class=\"value-red\">update@windows-update.site<\/td>\n    <\/tr>\n    <tr>\n      <td class=\"label\">Recipient<\/td>\n      <td class=\"value\">dylan@letsdefend.io<\/td>\n    <\/tr>\n    <tr>\n      <td class=\"label-red\">Action<\/td>\n      <td class=\"value-red\">Allowed (delivered to inbox)<\/td>\n    <\/tr>\n  <\/tbody><\/table>\n<\/div>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"948\" height=\"170\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/event-time.png\" alt=\"\" class=\"wp-image-261\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/event-time.png 948w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/event-time-300x54.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/event-time-764x137.png 764w\" sizes=\"auto, (max-width: 948px) 100vw, 948px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"265\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/smtp-address-1024x265.png\" alt=\"\" class=\"wp-image-262\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/smtp-address-1024x265.png 1024w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/smtp-address-300x78.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/smtp-address-766x198.png 766w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/smtp-address.png 1076w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"574\" height=\"190\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/sender-domain.png\" alt=\"\" class=\"wp-image-263\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/sender-domain.png 574w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/sender-domain-300x99.png 300w\" sizes=\"auto, (max-width: 574px) 100vw, 574px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1004\" height=\"157\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/destination-address.png\" alt=\"\" class=\"wp-image-264\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/destination-address.png 1004w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/destination-address-300x47.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/destination-address-767x120.png 767w\" sizes=\"auto, (max-width: 1004px) 100vw, 1004px\" \/><\/figure>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color wp-elements-5 wp-block-paragraph\">Email Content Analysis<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The email claimed to be from Microsoft, urgently pushing the recipient to upgrade to Windows 11 Pro for free.  Opening it in the Email Security section revealed the following red flags:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Urgent language pushing for immediate action<\/li>\n\n\n\n<li>Excessive repetition of the Update Now button<\/li>\n\n\n\n<li>Sender domain with no Microsoft affiliation whatsoever<\/li>\n\n\n\n<li>The Update Now button linked to a malicious URL rather than any Microsoft domain. <\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"726\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/update-now-email-1024x726.png\" alt=\"\" class=\"wp-image-265\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/update-now-email-1024x726.png 1024w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/update-now-email-300x213.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/update-now-email-768x544.png 768w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/update-now-email.png 1345w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<style>\n.callout { border-radius: 4px; padding: 14px 16px; margin-bottom: 16px; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.6; }\n.callout-title { font-weight: 700; margin-bottom: 6px; }\n.callout-red { background: #FEE2E2; border-left: 4px solid #DC2626; }\n.callout-red .callout-title { color: #DC2626; }\n.callout-red p { color: #1f2937; margin: 0; }\n<\/style>\n\n<div class=\"callout callout-red\">\n  <div class=\"callout-title\">Red Flag Note<\/div>\n  <p>The email was sent at 2:44 AM, which is an odd time for a legitimate corporate software update communication. Legitimate Microsoft update notifications do not arrive in the middle of the night urging you to click a link immediately.<\/p>\n<\/div>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color wp-elements-6 wp-block-paragraph\">Does the Email Contain Attachments or URLs?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Yes.  The Update Now button contained a hyperlink to a malicious URL.  To inspect it without clicking, hover over the button and check the URL preview in the browser&#8217;s bottom-left corner.  It did not point to anything Microsoft related.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"677\" height=\"438\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Analyze-URL.png\" alt=\"\" class=\"wp-image-266\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Analyze-URL.png 677w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Analyze-URL-300x194.png 300w\" sizes=\"auto, (max-width: 677px) 100vw, 677px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-7 wp-block-paragraph\">Step 3: Analyze the URL<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Before touching anything, the suspicious URL went into VirusTotal for a quick reputation check. <\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"799\" height=\"610\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/virus-total-search.png\" alt=\"\" class=\"wp-image-267\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/virus-total-search.png 799w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/virus-total-search-300x229.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/virus-total-search-768x586.png 768w\" sizes=\"auto, (max-width: 799px) 100vw, 799px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"468\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/virus-total-1024x468.png\" alt=\"\" class=\"wp-image-279\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/virus-total-1024x468.png 1024w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/virus-total-300x137.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/virus-total-767x350.png 767w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/virus-total-1536x701.png 1536w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/virus-total.png 1625w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<style>\n.vt-table { width: 100%; border-collapse: collapse; border: 1px solid #d1d5db; font-family: Arial, sans-serif; font-size: 14px; }\n.vt-table td { padding: 9px 14px; border-bottom: 1px solid #fecaca; vertical-align: middle; }\n.vt-table tr:last-child td { border-bottom: none; }\n.vt-table .label-red { font-weight: 600; width: 180px; color: #991B1B; background: #FEF2F2; border-right: 1px solid #fecaca; }\n.vt-table .value-red { color: #1f2937; background: #FEF2F2; }\n<\/style>\n\n<table class=\"vt-table\">\n  <tbody><tr>\n    <td class=\"label-red\">VirusTotal Result<\/td>\n    <td class=\"value-red\">15\/92 detections flagged as malicious phishing<\/td>\n  <\/tr>\n\n<\/tbody><\/table>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-8 wp-block-paragraph\">Step 4: Was the Email Delivered to the Recipient?<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Back to the alert details.  The Action field confirmed: Allowed.  The email made it to Dylan&#8217;s inbox without being caught by email filtering.  This shifts the investigation to the endpoint.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"816\" height=\"79\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/allowed.png\" alt=\"\" class=\"wp-image-269\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/allowed.png 816w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/allowed-300x29.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/allowed-764x74.png 764w\" sizes=\"auto, (max-width: 816px) 100vw, 816px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-9 wp-block-paragraph\">Step 5: Delete the Email from the Recipient&#8217;s Inbox<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">With the email confirmed as malicious and delivered, the next playbook step was removing it from Dylan&#8217;s mailbox immediately to eliminate any chance of a second click.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"692\" height=\"224\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Delete-from-recipient.png\" alt=\"\" class=\"wp-image-270\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Delete-from-recipient.png 692w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/Delete-from-recipient-300x97.png 300w\" sizes=\"auto, (max-width: 692px) 100vw, 692px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-10 wp-block-paragraph\">Step 6: Check the Endpoint<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">This is where things got more serious.  Dylan&#8217;s workstation was pulled in the Endpoint Security section and the browser history was reviewed.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"344\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/endpoint-security-1-1024x344.png\" alt=\"\" class=\"wp-image-273\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/endpoint-security-1-1024x344.png 1024w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/endpoint-security-1-300x101.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/endpoint-security-1-768x258.png 768w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/endpoint-security-1.png 1378w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The malicious URL had been accessed.  Dylan clicked the link. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"776\" height=\"182\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/browser-history.png\" alt=\"\" class=\"wp-image-272\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/browser-history.png 776w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/browser-history-300x70.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/browser-history-767x180.png 767w\" sizes=\"auto, (max-width: 776px) 100vw, 776px\" \/><\/figure>\n\n\n\n<style>\n.callout { border-radius: 4px; padding: 14px 16px; margin-bottom: 16px; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.6; }\n.callout-title { font-weight: 700; margin-bottom: 6px; }\n.callout-red { background: #FEE2E2; border-left: 4px solid #DC2626; }\n.callout-red .callout-title { color: #DC2626; }\n.callout-red p { color: #1f2937; margin: 0; }\n<\/style>\n\n<div class=\"callout callout-red\">\n  <div class=\"callout-title\">Key Finding<\/div>\n  <p>This is the moment in every investigation where you stop hoping it was a false positive and start thinking about containment. The user accessed a confirmed malicious URL that delivers Lumma Stealer via DLL side-loading. The endpoint needs to be isolated immediately.\n<\/p>\n<\/div>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color wp-elements-11 wp-block-paragraph\">Did the User Open the Malicious File or URL?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, confirmed through the browser history.  The playbook asks this question specifically to determine whether containment is required.  The answer here is unambiguous.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"691\" height=\"346\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/opened-the-file.png\" alt=\"\" class=\"wp-image-274\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/opened-the-file.png 691w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/opened-the-file-300x150.png 300w\" sizes=\"auto, (max-width: 691px) 100vw, 691px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-12 wp-block-paragraph\">Step 7: Contain the Endpoint<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">With confirmed endpoint access to a malicious URL, the next step was isolation.  In the Endpoint Security tab, the Contain button was toggled to cut Dylan&#8217;s workstation off from the network.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"737\" height=\"234\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/containment.png\" alt=\"\" class=\"wp-image-275\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/containment.png 737w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/containment-300x95.png 300w\" sizes=\"auto, (max-width: 737px) 100vw, 737px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"395\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/contained-1024x395.png\" alt=\"\" class=\"wp-image-276\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/contained-1024x395.png 1024w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/contained-300x116.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/contained-767x296.png 767w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/contained.png 1034w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<style>\n.callout { border-radius: 4px; padding: 14px 16px; margin-bottom: 16px; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.6; }\n.callout-title { font-weight: 700; margin-bottom: 6px; }\n.callout-green { background: #D1FAE5; border-left: 4px solid #059669; }\n.callout-green .callout-title { color: #059669; }\n.callout-green p { color: #1f2937; margin: 0; }\n<\/style>\n\n<div class=\"callout callout-green\">\n  <div class=\"callout-title\">Why Containment Matters\n<\/div>\n  <p>Containment isolates the machine from the network while preserving it for forensic review. This stops any potential lateral movement or data exfiltration that Lumma Stealer may have already initiated, without destroying the evidence trail needed for a full investigation.\n<\/p>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color wp-elements-13 wp-block-paragraph\">Verdict and Case Closure<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<style>\n.verdict-table { width: 100%; border-collapse: collapse; border: 1px solid #d1d5db; font-family: Arial, sans-serif; font-size: 14px; }\n.verdict-table td { padding: 9px 14px; border-bottom: 1px solid #e5e7eb; vertical-align: middle; }\n.verdict-table tr:last-child td { border-bottom: none; }\n.verdict-table .label { font-weight: 600; width: 200px; border-right: 1px solid #e5e7eb; }\n.verdict-table .label-red { color: #991B1B; background: #FEF2F2; border-right: 1px solid #fecaca; border-bottom: 1px solid #fecaca; }\n.verdict-table .value-red { background: #FEF2F2; color: #1f2937; border-bottom: 1px solid #fecaca; }\n.verdict-table .label-green { color: #065F46; background: #F0FDF4; border-right: 1px solid #bbf7d0; border-bottom: 1px solid #bbf7d0; }\n.verdict-table .value-green { background: #F0FDF4; color: #1f2937; border-bottom: 1px solid #bbf7d0; }\n<\/style>\n\n<table class=\"verdict-table\">\n  <tr>\n    <td class=\"label label-red\">Final Verdict<\/td>\n    <td class=\"value-red\">True Positive<\/td>\n  <\/tr>\n  <tr>\n    <td class=\"label label-green\">Action Taken<\/td>\n    <td class=\"value-green\">Email deleted, endpoint contained<\/td>\n  <\/tr>\n  <tr>\n    <td class=\"label label-red\">Escalation Required<\/td>\n    <td class=\"value-red\">Yes, for full forensic review of Dylan&#8217;s workstation<\/td>\n  <\/tr>\n<\/table>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"378\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/End-1024x378.png\" alt=\"\" class=\"wp-image-277\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/End-1024x378.png 1024w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/End-300x111.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/End-767x283.png 767w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/End.png 1252w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The alert was closed as a True Positive.  Every step of the chain confirmed it; a convincing phishing email pretending to be a Microsoft update, a malicious URL confirmed by VirusTotal, delivery to the recipient&#8217;s inbox, and confirmed endpoint access.  They playbook worked exactly as designed. <\/p>\n\n\n\n<style>\n.analyst-note { background: #F8FAFC; border-left: 4px solid #0e7490; border-radius: 4px; padding: 14px 16px; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.7; color: #1f2937; margin-bottom: 20px; }\n.analyst-note-title { font-weight: 700; color: #0e7490; margin-bottom: 8px; }\n<\/style>\n\n<div class=\"analyst-note\">\n  <div class=\"analyst-note-title\">Analyst Note<\/div>\n  I investigated an alert related to a Lumma Stealer malware infection attempt delivered through a phishing email exploiting DLL side-loading techniques. I started the Playbook, took note of the Event Time, SMTP address, sender domain, and recipient address, then navigated to Email Security and identified multiple red flags including urgent language, excessive repetition of the Update Now button, and a sender domain with no Microsoft affiliation. I analyzed the URL in VirusTotal which returned 15\/92 detections flagging it as malicious phishing. I confirmed the email was delivered to the recipient&#8217;s inbox and that Dylan accessed the malicious URL via browser history. The email was deleted from the user&#8217;s inbox and the endpoint was contained.\n<\/div>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color wp-elements-14 wp-block-paragraph\">MITRE ATT&amp;CK Tags<\/p>\n\n\n\n<style>\n.mitre-table { width: 100%; border-collapse: collapse; border: 1px solid #d1d5db; font-family: Arial, sans-serif; font-size: 14px; margin-bottom: 20px; }\n.mitre-table th { background: #1A1A2E; color: #ffffff; font-weight: 600; padding: 9px 14px; text-align: left; }\n.mitre-table td { padding: 9px 14px; border-bottom: 1px solid #e5e7eb; vertical-align: middle; }\n.mitre-table tr:last-child td { border-bottom: none; }\n.mitre-table tr:nth-child(even) td { background: #F9FAFB; }\n.mitre-tag { display: inline-block; background: #ECFDF5; color: #065F46; font-weight: 700; font-size: 12px; padding: 2px 10px; border-radius: 20px; font-family: monospace; }\n<\/style>\n\n<table class=\"mitre-table\">\n  <tr>\n    <th>Technique ID<\/th>\n    <th>Technique Name<\/th>\n    <th>Tactic<\/th>\n  <\/tr>\n  <tr>\n    <td><span class=\"mitre-tag\">T1059<\/span><\/td>\n    <td>Command and Scripting Interpreter<\/td>\n    <td>Execution<\/td>\n  <\/tr>\n  <tr>\n    <td><span class=\"mitre-tag\">T1059.001<\/span><\/td>\n    <td>PowerShell<\/td>\n    <td>Execution<\/td>\n  <\/tr>\n  <tr>\n    <td><span class=\"mitre-tag\">T1204<\/span><\/td>\n    <td>User Execution<\/td>\n    <td>Execution<\/td>\n  <\/tr>\n  <tr>\n    <td><span class=\"mitre-tag\">T1204.001<\/span><\/td>\n    <td>Malicious Link<\/td>\n    <td>Execution<\/td>\n  <\/tr>\n  <tr>\n    <td><span class=\"mitre-tag\">T1574<\/span><\/td>\n    <td>Hijack Execution Flow<\/td>\n    <td>Persistence, Privilege Escalation, Defense Evasion<\/td>\n  <\/tr>\n  <tr>\n    <td><span class=\"mitre-tag\">T1574.002<\/span><\/td>\n    <td>DLL Side-Loading<\/td>\n    <td>Persistence, Privilege Escalation, Defense Evasion<\/td>\n  <\/tr>\n  <tr>\n    <td><span class=\"mitre-tag\">T1027<\/span><\/td>\n    <td>Obfuscated Files or Information<\/td>\n    <td>Defense Evasion<\/td>\n  <\/tr>\n  <tr>\n    <td><span class=\"mitre-tag\">T1105<\/span><\/td>\n    <td>Ingress Tool Transfer<\/td>\n    <td>Command and Control<\/td>\n  <\/tr>\n<\/table>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-15 wp-block-paragraph\">Why This Attack is Interesting<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">The combination of ClickFix social engineering and Lumma Stealer payload is what pushed this alert to Critical severity.  Neither piece alone is as dangerous as the two working together.<\/p>\n\n\n\n<style>\n.callout { border-radius: 4px; padding: 14px 16px; margin-bottom: 16px; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.6; }\n.callout-title { font-weight: 700; margin-bottom: 6px; }\n.callout-purple { background: #F5F3FF; border-left: 4px solid #7C3AED; }\n.callout-purple .callout-title { color: #7C3AED; }\n.callout-purple p { color: #1f2937; margin: 0; }\n.callout-amber { background: #FFFBEB; border-left: 4px solid #D97706; }\n.callout-amber .callout-title { color: #D97706; }\n.callout-amber p { color: #1f2937; margin: 0; }\n<\/style>\n\n<div class=\"callout callout-purple\">\n  <div class=\"callout-title\">The ClickFix Technique\n<\/div>\n  <p>ClickFix works because it exploits the user&#8217;s instinct to fix something that appears broken. A fake Windows update prompt is particularly effective because most users are conditioned to apply updates promptly. The attacker knows this and uses it. The same technique is appearing increasingly in phishing campaigns with fake CAPTCHA prompts, fake browser error messages, and fake software license pop-ups.\n<\/p>\n<\/div>\n\n<div class=\"callout callout-amber\">\n  <div class=\"callout-title\">DLL Side-Loading\n<\/div>\n  <p>Lumma Stealer uses DLL side-loading to execute by hijacking a legitimate Windows process rather than running as an obvious malicious executable. This makes it harder for traditional endpoint security tools to flag it because from the OS perspective a known-good process is loading a DLL, which is normal behavior. The malicious DLL just happens to be substituted in place of the legitimate one.\n<\/p>\n<\/div>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color wp-elements-16 wp-block-paragraph\">Takeaways<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-ast-global-color-2-color has-text-color has-link-color wp-elements-17\">The playbook-driven approach is what made this investigation efficient. Each step had a clear question and a clear action, which kept the investigation moving in a straight line rather than in circles.<\/li>\n\n\n\n<li class=\"has-ast-global-color-2-color has-text-color has-link-color wp-elements-18\">Check the endpoint even when you expect it is fine. The instinct after deleting the email might be to close the case. The playbook correctly pushes you to verify whether the link was accessed before assuming containment is complete.<\/li>\n\n\n\n<li class=\"has-ast-global-color-2-color has-text-color has-link-color wp-elements-19\">Contain first, investigate second. Once you confirm endpoint access to confirmed malicious content, containment takes priority over additional investigation. Stop the bleeding, then look at the wound.<\/li>\n<\/ul>\n\n\n\n<style>\n.author-bio { display: flex; align-items: flex-start; gap: 16px; background: #050C18; border-radius: 8px; padding: 20px; font-family: Arial, sans-serif; margin-bottom: 20px; border: 1px solid #0D1E35; }\n.author-avatar { width: 72px; height: 72px; border-radius: 50%; background: #0D1E35; border: 2px solid #00D4FF; flex-shrink: 0; display: flex; align-items: center; justify-content: center; font-size: 26px; font-weight: 700; color: #00D4FF; font-family: monospace; }\n.author-content { flex: 1; }\n.author-name { font-size: 16px; font-weight: 700; color: #ffffff; margin: 0 0 2px 0; }\n.author-title { font-size: 12px; color: #00D4FF; margin: 0 0 10px 0; letter-spacing: 0.04em; }\n.author-text { font-size: 13.5px; color: #94A3B8; line-height: 1.6; margin: 0 0 12px 0; }\n.author-links { display: flex; gap: 10px; flex-wrap: wrap; }\n.author-link { font-size: 12px; font-weight: 600; padding: 4px 12px; border-radius: 20px; text-decoration: none; }\n.link-site { background: #00D4FF; color: #050C18; }\n.link-linkedin { background: #0D1E35; color: #00D4FF; border: 1px solid #00D4FF; }\n.link-github { background: #0D1E35; color: #00D4FF; border: 1px solid #00D4FF; }\n<\/style>\n\n<div class=\"author-bio\">\n  <div class=\"author-avatar\">RM<\/div>\n  <div class=\"author-content\">\n    <p class=\"author-name\">Ron Mercier<\/p>\n    <p class=\"author-title\">CLOUD &nbsp;\u00b7&nbsp; CYBERSECURITY &nbsp;\u00b7&nbsp; SECUREBYDEFAULT.IO<\/p>\n    <p class=\"author-text\">Ron is a Cloud and Cybersecurity Engineer and the founder of SecureByDefault.io. He writes hands-on security walkthroughs from real investigations, not theory. Follow along for practical blue team content, server hardening guides, and SOC analyst practice.<\/p>\n    <div class=\"author-links\">\n      <a class=\"author-link link-site\" href=\"https:\/\/securebydefault.io\">SecureByDefault.io<\/a>\n      <a class=\"author-link link-linkedin\" href=\"https:\/\/linkedin.com\/in\/ron-mercier\">LinkedIn<\/a>\n      <a class=\"author-link link-github\" href=\"https:\/\/github.com\/RonMercier\">GitHub<\/a>\n    <\/div>\n  <\/div>\n<\/div>\n\n\n\n<div style=\"margin:48px 0 20px;padding:36px 32px;background:#050C18;border:1px solid #1A3A5C;border-top:3px solid #00D4FF;border-radius:8px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;text-align:center;\">\n\n  <div style=\"font-family:'Courier New',monospace;font-size:11px;letter-spacing:0.18em;text-transform:uppercase;color:#00D4FF;margin-bottom:14px;\">\n    \/\/ Before you go\n  <\/div>\n\n  <h3 style=\"margin:0 0 14px;font-size:24px;font-weight:800;color:#EEF5FF;line-height:1.25;\">\n    Get the security checklist most<br>businesses skip.\n  <\/h3>\n\n  <p style=\"margin:0 auto 24px;max-width:440px;font-size:15px;line-height:1.65;color:#8BB8D8;\">\n    A free 25-point audit covering the exact gaps attackers hit first, written by an engineer in plain language. Plus one practical security breakdown every Tuesday.\n  <\/p>\n\n  <a href=\"https:\/\/newsletter.securebydefault.io\" target=\"_blank\" rel=\"noopener\"\n     style=\"display:inline-block;background:#00D4FF;color:#050C18;text-decoration:none;\n     font-weight:700;font-size:15px;padding:15px 36px;border-radius:4px;letter-spacing:0.02em;\">\n    Get the Free Checklist &rarr;\n  <\/a>\n\n  <p style=\"margin:18px 0 0;font-family:'Courier New',monospace;font-size:11px;color:#4A7A9B;letter-spacing:0.04em;\">\n    Free on signup &nbsp;\u00b7&nbsp; Unsubscribe anytime &nbsp;\u00b7&nbsp; ~1 email per week\n  <\/p>\n\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A hands-on walkthrough of LetsDefend SOC338. Lumma Stealer delivered via ClickFix phishing and DLL side-loading. Real investigation steps, MITRE tags, and verdict.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[38,84,37,85,105,26],"tags":[48,101,118,116,117,41,39,114,47,49,33,51],"class_list":["post-253","post","type-post","status-publish","format-standard","hentry","category-blue-team","category-email-security","category-incident-response","category-phishing-awareness","category-soc","category-web-security","tag-blue-team","tag-clickfix","tag-data-leakage","tag-dll-side-loading","tag-endpoint-security","tag-incident-response","tag-letsdefend","tag-lumma-stealer","tag-malware-analysis","tag-mitre-attck","tag-phishing","tag-soc-walkthrough"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>SOC338 LetsDefend Walkthrough: Lumma Stealer via DLL Side-Loading (ClickFix Phishing) - SecureByDefault SOC338: Lumma Stealer via ClickFix Phishing | LetsDefend Walkthrough<\/title>\n<meta name=\"description\" content=\"A hands-on walkthrough of LetsDefend SOC338. Lumma Stealer delivered via ClickFix phishing and DLL side-loading. Real investigation steps, MITRE tags, and verdict.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SOC338: Lumma Stealer via ClickFix Phishing\" \/>\n<meta property=\"og:description\" content=\"Walked through a Critical LetsDefend alert involving Lumma Stealer, ClickFix phishing, and DLL side-loading. Here is exactly what I found and what I did.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/\" \/>\n<meta property=\"og:site_name\" content=\"SecureByDefault\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-20T18:57:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-21T10:49:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/LDefend.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"720\" \/>\n\t<meta property=\"og:image:height\" content=\"376\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ron Mercier\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ron Mercier\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\\\/\"},\"author\":{\"name\":\"Ron Mercier\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#\\\/schema\\\/person\\\/2ee989263a69e3324bce0cbed28ec0e8\"},\"headline\":\"SOC338 LetsDefend Walkthrough: Lumma Stealer via DLL Side-Loading (ClickFix Phishing)\",\"datePublished\":\"2026-08-20T18:57:42+00:00\",\"dateModified\":\"2026-08-21T10:49:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\\\/\"},\"wordCount\":1440,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#\\\/schema\\\/person\\\/2ee989263a69e3324bce0cbed28ec0e8\"},\"image\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/LDefend.jpg\",\"keywords\":[\"blue team\",\"ClickFix\",\"Data Leakage\",\"DLL Side-Loading\",\"Endpoint Security\",\"incident response\",\"LetsDefend\",\"Lumma Stealer\",\"malware analysis\",\"MITRE ATT&amp;CK\",\"phishing\",\"SOC walkthrough\"],\"articleSection\":[\"Blue Team\",\"Email Security\",\"Incident Response\",\"Phishing Awareness\",\"SOC\",\"Web Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/securebydefault.io\\\/blog\\\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\\\/\",\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\\\/\",\"name\":\"SOC338 LetsDefend Walkthrough: Lumma Stealer via DLL Side-Loading (ClickFix Phishing) - SecureByDefault SOC338: Lumma Stealer via ClickFix Phishing | LetsDefend Walkthrough\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/LDefend.jpg\",\"datePublished\":\"2026-08-20T18:57:42+00:00\",\"dateModified\":\"2026-08-21T10:49:25+00:00\",\"description\":\"A hands-on walkthrough of LetsDefend SOC338. Lumma Stealer delivered via ClickFix phishing and DLL side-loading. Real investigation steps, MITRE tags, and verdict.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/securebydefault.io\\\/blog\\\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\\\/#primaryimage\",\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/LDefend.jpg\",\"contentUrl\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/LDefend.jpg\",\"width\":720,\"height\":376},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SOC338 LetsDefend Walkthrough: Lumma Stealer via DLL Side-Loading (ClickFix Phishing)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/\",\"name\":\"SecureByDefault\",\"description\":\"Cloud Security &amp; Cybersecurity for IT Professionals\",\"publisher\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#\\\/schema\\\/person\\\/2ee989263a69e3324bce0cbed28ec0e8\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#\\\/schema\\\/person\\\/2ee989263a69e3324bce0cbed28ec0e8\",\"name\":\"Ron Mercier\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SecureByDefault_Log.png\",\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SecureByDefault_Log.png\",\"contentUrl\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SecureByDefault_Log.png\",\"width\":512,\"height\":512,\"caption\":\"Ron Mercier\"},\"logo\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SecureByDefault_Log.png\"},\"sameAs\":[\"https:\\\/\\\/securebydefault.io\\\/blog\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/ron-mercier\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCDyWOTMI23S8Y3zwPoX3UkQ\"],\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/author\\\/sbd_admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SOC338 LetsDefend Walkthrough: Lumma Stealer via DLL Side-Loading (ClickFix Phishing) - SecureByDefault SOC338: Lumma Stealer via ClickFix Phishing | LetsDefend Walkthrough","description":"A hands-on walkthrough of LetsDefend SOC338. Lumma Stealer delivered via ClickFix phishing and DLL side-loading. Real investigation steps, MITRE tags, and verdict.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/","og_locale":"en_US","og_type":"article","og_title":"SOC338: Lumma Stealer via ClickFix Phishing","og_description":"Walked through a Critical LetsDefend alert involving Lumma Stealer, ClickFix phishing, and DLL side-loading. Here is exactly what I found and what I did.","og_url":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/","og_site_name":"SecureByDefault","article_published_time":"2026-08-20T18:57:42+00:00","article_modified_time":"2026-08-21T10:49:25+00:00","og_image":[{"width":720,"height":376,"url":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/LDefend.jpg","type":"image\/jpeg"}],"author":"Ron Mercier","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Ron Mercier","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/#article","isPartOf":{"@id":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/"},"author":{"name":"Ron Mercier","@id":"https:\/\/securebydefault.io\/blog\/#\/schema\/person\/2ee989263a69e3324bce0cbed28ec0e8"},"headline":"SOC338 LetsDefend Walkthrough: Lumma Stealer via DLL Side-Loading (ClickFix Phishing)","datePublished":"2026-08-20T18:57:42+00:00","dateModified":"2026-08-21T10:49:25+00:00","mainEntityOfPage":{"@id":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/"},"wordCount":1440,"commentCount":0,"publisher":{"@id":"https:\/\/securebydefault.io\/blog\/#\/schema\/person\/2ee989263a69e3324bce0cbed28ec0e8"},"image":{"@id":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/#primaryimage"},"thumbnailUrl":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/LDefend.jpg","keywords":["blue team","ClickFix","Data Leakage","DLL Side-Loading","Endpoint Security","incident response","LetsDefend","Lumma Stealer","malware analysis","MITRE ATT&amp;CK","phishing","SOC walkthrough"],"articleSection":["Blue Team","Email Security","Incident Response","Phishing Awareness","SOC","Web Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/","url":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/","name":"SOC338 LetsDefend Walkthrough: Lumma Stealer via DLL Side-Loading (ClickFix Phishing) - SecureByDefault SOC338: Lumma Stealer via ClickFix Phishing | LetsDefend Walkthrough","isPartOf":{"@id":"https:\/\/securebydefault.io\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/#primaryimage"},"image":{"@id":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/#primaryimage"},"thumbnailUrl":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/LDefend.jpg","datePublished":"2026-08-20T18:57:42+00:00","dateModified":"2026-08-21T10:49:25+00:00","description":"A hands-on walkthrough of LetsDefend SOC338. Lumma Stealer delivered via ClickFix phishing and DLL side-loading. Real investigation steps, MITRE tags, and verdict.","breadcrumb":{"@id":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/#primaryimage","url":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/LDefend.jpg","contentUrl":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/LDefend.jpg","width":720,"height":376},{"@type":"BreadcrumbList","@id":"https:\/\/securebydefault.io\/blog\/soc338-lumma-stealer-dll-side-loading-clickfix-phishing\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/securebydefault.io\/blog\/"},{"@type":"ListItem","position":2,"name":"SOC338 LetsDefend Walkthrough: Lumma Stealer via DLL Side-Loading (ClickFix Phishing)"}]},{"@type":"WebSite","@id":"https:\/\/securebydefault.io\/blog\/#website","url":"https:\/\/securebydefault.io\/blog\/","name":"SecureByDefault","description":"Cloud Security &amp; Cybersecurity for IT Professionals","publisher":{"@id":"https:\/\/securebydefault.io\/blog\/#\/schema\/person\/2ee989263a69e3324bce0cbed28ec0e8"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/securebydefault.io\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/securebydefault.io\/blog\/#\/schema\/person\/2ee989263a69e3324bce0cbed28ec0e8","name":"Ron Mercier","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/05\/SecureByDefault_Log.png","url":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/05\/SecureByDefault_Log.png","contentUrl":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/05\/SecureByDefault_Log.png","width":512,"height":512,"caption":"Ron Mercier"},"logo":{"@id":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/05\/SecureByDefault_Log.png"},"sameAs":["https:\/\/securebydefault.io\/blog","https:\/\/www.linkedin.com\/in\/ron-mercier\/","https:\/\/www.youtube.com\/channel\/UCDyWOTMI23S8Y3zwPoX3UkQ"],"url":"https:\/\/securebydefault.io\/blog\/author\/sbd_admin\/"}]}},"_links":{"self":[{"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/posts\/253","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/comments?post=253"}],"version-history":[{"count":11,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/posts\/253\/revisions"}],"predecessor-version":[{"id":291,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/posts\/253\/revisions\/291"}],"wp:attachment":[{"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/media?parent=253"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/categories?post=253"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/tags?post=253"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}