Family comparison

Lumma StealerRemusStealC
Capability
Lumma StealerActive
RemusActive
StealCActive
PlatformWindowsWindowsWindows
Dark Radar infection records6,485,618269,9221,847,820
Credentials
Browser passwordsVerifiedVerifiedVerified
Session cookiesVerifiedVerifiedVerified
Refreshing expired sessionsReported——
AutofillVerifiedDark Radar observationVerified
macOS Keychain———
2FA and password managersVerified——
Financial
Saved cardsVerifiedDark Radar observationDark Radar observation
Desktop crypto walletsVerifiedVerifiedVerified
Wallet extensionsVerifiedVerifiedVerified
Clipboard address replacement———
Applications
Email clientsVersion-dependent—Verified
FTP clients——Dark Radar observation
VPN clients———
Messaging applicationsVersion-dependentDark Radar observationVerified
Gaming platformsDark Radar observationDark Radar observationDark Radar observation
System
File collectionVerified—Verified
Screenshot——Version-dependent
System inventoryVerifiedVerifiedVerified
Behavior
Additional payload downloadVerified—Verified
Persistence———
Anti-analysisVerifiedVerifiedVerified
Verified
Version-dependent
Reported
Dark Radar observation
Not observed