Attackers using the Lumma Stealer malware platform are deploying a secondary remote access trojan, SectopRAT, on already-infected Windows machines, turning what appears to be a credential theft incident into a persistent network intrusion. Any organization with Windows endpoints is a potential target; financial services, cryptocurrency operations, and businesses relying on browser-stored credentials face heightened exposure. Despite a May 2025 law enforcement disruption, Lumma’s Malware-as-a-Service model has reconstituted rapidly, meaning the threat remains active and the business risk extends well beyond stolen passwords to full attacker persistence inside the network.