Active threat familyWindowsCredential theft
Malware Intelligence

Lumma Stealer

Lumma is an infostealer written in C and sold by subscription on Russian-speaking forums. It targets browser passwords and cookies, crypto wallets and two-factor authentication extensions, and can download and run additional payloads.

In May 2025, a joint operation by Microsoft, Europol and the US Department of Justice seized most of its infrastructure; it was rebuilt shortly afterwards.

Activity map

Activity mapJavaScriptUser pastesCommandChild processIn memoryPackagingExfiltrationDownloadExtractionDownloadsDownloadDownloadExtractionExecutionFake verificationpageClickFixCommand copiedto the clipboardRun dialogWin + Rmshta.exeRemote HTAPowerShellObfuscated scriptDownload from aremote serverEncrypted payloadLumma StealerInfostealerData collection25 targetsLog archiveC2 serverFake GitHubrepositoryReleasesZIPArchiveSmartLoaderLuaJIT scriptUnlicensedsoftware siteCrack, keygenSponsoredsearch adPopular software nameZIPPassword-protectedarchiveEXESetup.exeInflated size
Executable payloadFile
Malicious payloadLumma Stealer · Infostealer

Lumma is an infostealer written in C and sold by subscription on Russian-speaking forums. It targets browser passwords and cookies, crypto wallets and two-factor authentication extensions, and can download and run additional payloads.

Appears in flows

Environment information

  • Operating system
  • Hardware
  • IP and location
  • Installed software
  • Running processes
  • Desktop files

Credentials and application data

  • Saved passwords
  • Session cookies
  • Session refresh data
  • Autofill
  • Saved cards
  • 2FA seeds
  • Discord
  • Steam
  • Telegram
  • Phantom
  • Mozilla Thunderbird
  • MetaMask
  • Authenticator
  • Coinbase Wallet
Dark Radar infection records
6,485,618
Latest infection record
29 October 2026
Malware type
Infostealer
First seen
August 2022
01

Overview

It was the most widespread stealer family in 2023–2025. Its distribution chain, which uses fake CAPTCHA pages to make the user paste a command, bypasses email security layers entirely.

Ranks 2 of 52 families in Dark Radar data, with 6,485,618 infection records.

Other names: LummaC2, LummaC2 Stealer

02

Origin and evolution

  1. August 2022Put up for sale on forums by "Shamel" (alias "Lumma").Malpedia (Fraunhofer FKIE)
  2. 2023Announced a feature to revive expired Google sessions.Malpedia (Fraunhofer FKIE)
  3. 2024Fake CAPTCHA and ClickFix distribution became widespread.Varist
  4. May 2025Its domains and panels were seized in an international operation.Trend Micro
  5. 2025Infrastructure was rebuilt; browser fingerprinting was added.Trend Micro
  6. 2026Remus, assessed to be its 64-bit successor, appeared.Gen Digital
03

Technical profile

Malware typeInfostealer
Target operating systemWindows
Primary purposeCredential and session theft
Threat categoryCredential theft
Programming languageC
Distribution modelSubscription service (MaaS)
First seenAugust 2022
Public source confidenceHigh
04

Targeted applications

25 applications8 categories
05

Data collection

Credentials

  • Browser passwords96.5%Verified
  • Session cookies91%Verified
  • Refreshing expired sessionsReported
  • Autofill56%Verified
  • macOS Keychain—
  • 2FA and password managersVerified

Financial

  • Saved cards3.5%Verified
  • Desktop crypto walletsVerified
  • Wallet extensionsVerified
  • Clipboard address replacement—

Applications

  • Email clientsVersion-dependent
  • FTP clients—
  • VPN clients—
  • Messaging applications34.5%Version-dependent
  • Gaming platforms30%Dark Radar observation

System

  • File collectionVerified
  • Screenshot—
  • System inventory46.5%Verified

Behavior

  • Additional payload downloadVerified
  • Persistence—
  • Anti-analysisVerified
06

File system

User profile (%USERPROFILE%)
File details are in Dark Radar IntelligenceOpen in Intelligence
07

System components

  • Installed software and process list
  • Hardware ID and screen resolution
  • Browser fingerprint (after 2025)
  • User and computer name, language settings
08

How it works

  1. 1Infection

    • A fake CAPTCHA page makes the user paste a command with Win+R (ClickFix).
    • Sponsored search results and unlicensed software sites.
    • Fake GitHub repositories and links in video descriptions.
    T1189Drive-by Compromise

    Breaking point: Email attachments, sponsored ad links and unlicensed software downloads are blocked at the email and web gateway.

  2. 2Execution and evasion

    • A downloader chain running in memory with mshta or PowerShell.
    • Payload injected into legitimate processes.
    Dark Radar observation

    The payload ran from the LocalAppData folder (latest 200 logs, 9.6%).

    Ran from the install.exe file in the Windows folder (latest 200 logs, 73.1%).

    Ran inside the legitimate MSBuild.exe process (latest 200 logs, 5.8%).

    T1204.004User Execution: Malicious Copy and PasteT1059.001PowerShellT1055Process InjectionT1027Obfuscated Files or InformationT1497Virtualization/Sandbox Evasion

    Breaking point: Unsigned files running from user folders and injections into .NET tools are stopped by application control and EDR.

  3. 3Discovery

    • System, hardware and language information is collected.
    • Virtual machine and analysis environment checks are performed.
    T1082System Information Discovery

    Breaking point: Bulk system and security software queries from a short-lived process trigger an EDR alert.

  4. 4Data collection

    • Browser databases, wallet extensions and desktop wallets are read.
    • Files are collected according to extensions defined in the panel.
    Dark Radar observation

    Data found in the latest 200 logs: password file 96.5%, cookies 91%, autofill 56%, cards 3.5%, wallets 2%.

    T1555.003Credentials from Web BrowsersT1539Steal Web Session CookieT1555.005Password ManagersT1005Data from Local System

    Breaking point: A process other than the browser reading browser profile files is blocked or triggers an alert.

  5. 5Exfiltration and C2

    • Data is sent to the C2 server with HTTP POST.
    • The C2 address can be resolved from intermediate points such as a Steam profile or Telegram channel.
    T1071.001Web ProtocolsT1102.001Dead Drop ResolverT1105Ingress Tool TransferT1041Exfiltration Over C2 Channel

    Breaking point: Traffic to newly registered domains, direct IP addresses and non-standard ports is blocked.

  6. 6Persistence and aftermath

    • Additional EXE, DLL or PowerShell payloads can be downloaded from the panel.

    Breaking point: When an infection is confirmed, all sessions and access tokens on the device are revoked.

09

Network communication

This section is in Dark Radar IntelligenceOpen in Intelligence
10

MITRE ATT&CK

Execution
Initial Access
Defense Evasion
Credential Access
Discovery
Collection
Command and Control
Exfiltration
11

IOCs and detection

This section is in Dark Radar IntelligenceOpen in Intelligence
12

Risk and impact

  • When corporate SSO cookies are stolen, sessions can be opened without a multi-factor authentication prompt.
  • If 2FA extension seeds are stolen, one-time codes are generated on the attacker's device.
  • Stolen session cookies are enough to take over cloud, email and SaaS sessions without a password or multi-factor authentication prompt.
  • Corporate passwords saved on personal devices also leak through infections outside the corporate network; these logs are sold to initial access brokers.
  • Log archives are reshared for years; as long as the password is not changed, the same credential can be used again and again.
  • Compromised email, messaging and social media accounts become the next link in phishing and malware distribution.
13

Defense

  • Restrict use of the Run dialog or block mshta.
  • Apply web filter rules against fake CAPTCHA patterns.
  • When an infection is detected, revoke not only the password but all related sessions and access tokens.
  • Turn off password saving in the browser through corporate policy; use a corporate password manager.
  • Move to phishing-resistant multi-factor authentication (FIDO2/passkey); bind sessions to the device.
  • Block setup files downloaded from unlicensed software, game cheats and sponsored search results.
  • Monitor flows where the user runs a command by pasting it into the Run dialog or terminal (ClickFix) with endpoint rules.
  • Continuously monitor your corporate domains and employee email addresses in stealer logs with Dark Radar.
14

Learning center

How does this malware spread?
  • A fake CAPTCHA page makes the user paste a command with Win+R (ClickFix).
  • Sponsored search results and unlicensed software sites.
  • Fake GitHub repositories and links in video descriptions.
  • The payload ran from the LocalAppData folder (latest 200 logs, 9.6%).
How can its presence on a system be detected?
  • Sign-ins to accounts from an unrecognized country or device.
  • A new infostealer log in Dark Radar for your corporate domain or an employee email address.
Which Windows artifacts should be examined?
  • Prefetch (C:\Windows\Prefetch) — shows that a short-lived payload ran.
  • Amcache.hve and ShimCache — path and hash of the executed file.
  • Downloads folder and Zone.Identifier stream — the address the file was downloaded from.
  • Browser history — the fake download page or fake CAPTCHA address.
  • RunMRU registry key — commands pasted into the Run dialog.
  • Randomly named folders and DLLs under %TEMP% and %LOCALAPPDATA%.
Which log records matter?
  • Sysmon Event 1 / Security 4688Process creation: unsigned processes starting from Temp and Downloads folders, mshta, powershell -enc chains.
  • Sysmon Olay 11 / 23File creation and deletion: self-deleting payloads, DLLs dropped under Temp.
  • Sysmon Olay 3 / 22Network connection and DNS query: to newly registered domains, C2 resolution via Telegram, Steam or Pastebin.
  • Object access auditing (4663)A process other than the browser reading Login Data, Cookies and Local State files.
  • PowerShell 4104Script block logging: obfuscated downloader commands.
  • Identity provider sign-in logsSessions after the infection from a different country and device, without a multi-factor authentication prompt.
Which MITRE techniques is it associated with?
T1204.004User Execution: Malicious Copy and PasteT1059.001PowerShellT1189Drive-by CompromiseT1055Process InjectionT1027Obfuscated Files or InformationT1497Virtualization/Sandbox EvasionT1555.003Credentials from Web BrowsersT1539Steal Web Session CookieT1555.005Password ManagersT1082System Information DiscoveryT1005Data from Local SystemT1071.001Web ProtocolsT1102.001Dead Drop ResolverT1105Ingress Tool TransferT1041Exfiltration Over C2 Channel
How should a SOC analyst respond?
  1. Isolate the device from the network; do not reinstall it before taking memory and disk images.
  2. Determine the infection date; list all accounts that were signed in on the device after that date.
  3. Change the passwords of these accounts, revoke their sessions and access tokens, and re-enroll multi-factor authentication devices.
  4. Search identity provider and SaaS logs for new country, device and token usage after the infection.
  5. If a recovery phrase or wallet file was exposed, move the assets to a new wallet.
  6. Find the initial access path (email, ad, unlicensed software, fake CAPTCHA) and check other users who used the same path.
  7. Reinstall the device from a clean image.
15

Sources

Related families

RemusStealCVidarCompare

Related terms

Stealer logsBotnet panel rentalMalware-as-a-ServiceAntidetect browserAccount takeoverCommand and control serverInfostealerHardware ID
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans