Loading malware…
Lumma Stealer, also known as LummaC2, is a Windows information-stealing malware family offered through a malware-as-a-service model since 2022. Distributed internationally by multiple criminal operators, it targets personal and corporate information rather than a single industry. Stolen logs are traded through criminal marketplaces and messaging platforms, providing credentials and authentication artifacts that can facilitate account takeover and subsequent network intrusion. Lumma has been deployed in Graceful Spider campaigns involving Truebot.
Lumma collects saved browser passwords, session cookies, browsing history, payment information, cryptocurrency-wallet data, and sensitive local files. Its configurable collection targets include Chromium-based browsers, Firefox, browser extensions, password managers, authentication applications, and FTP, VPN, and email clients. It also gathers system information, software inventories, and process lists, with optional clipboard collection and screenshots. Lumma generally follows a one-shot collection-and-exfiltration model, transmitting stolen information in ZIP archives. Its command-and-control functionality can also supply follow-up executables, DLLs, and PowerShell payloads.
Analyzed samples employ packing and process hollowing to conceal execution. Command-and-control addresses can be retrieved dynamically through Steam profiles and Telegram, supplementing embedded infrastructure. Its communications have evolved from Base64-and-XOR obfuscation to ChaCha20 encryption; later versions also encrypt exfiltrated archives and remove recognizable protocol parameters.
Distribution includes phishing attachments and links, fraudulent GitHub security messages, cracked software, fake browser updates, and ClickFix pages that imitate CAPTCHA checks and induce users to execute PowerShell commands. Lumma has also been delivered through loaders such as RenPy Loader and IDATLoader. Documented campaigns have exploited CVE-2024-21412 to bypass Microsoft Defender SmartScreen through WebDAV-hosted shortcuts. AliGater malvertising campaigns delivered Lumma through exploitation of CVE-2023-2033 and CVE-2011-3402 on vulnerable Windows and Chrome installations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
A recent report identified a new campaign exploiting CVE-2024-21412. It begins with phishing emails containing links to Internet shortcut files on WebDAV shares. | Clicking these links triggers scripts such as PowerShell and JavaScript, leading to the deployment of malicious payloads like Lumma and Meduza Stealer aimed at extracting sensitive information from victims.
The Win32 TrueType font parsing is an old known exploit (CVE-2011-3402) abused by the attackers to elevate the necessary privileges for subsequent operations.
We have observed payloads containing exploits targeting JavaScript engine V8 (CVE-2023-2033) and a TrueType font parsing in Windows (CVE-2011-3402).
이 취약점은 DarkGate 캠페인과 같은 실제 공격에서 악용되었다.
CVE-2026-1731 BeyondTrust RS/PRA 9.8 Yes (GitHub) Yes (BT26-02) ... CVE-2026-1731 (BeyondTrust) is associated with HAFNIUM and linked to Lumma Stealer, SparkRAT, and VShell malware deployments.
42 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These IOCs are associated with Truebot campaigns used by Graceful Spider to deliver FlawedGrace and LummaStealer payloads in May of 2023.
Employing the novel "ClickFix" technique impersonating IT tools, alongside more sophisticated tools including: LummaStealer, BerserkStealer and Custom Remote Access Trojans (RATs)
“The final payload that has been distributed at the time of research has been identified as Lumma stealer.”
Deployed information-stealing malware like “Lumma” and “StealC.”
The threat actor, tracked by Mandiant as UNC5587, used infostealer malware such as RedLine, Lumma, and Vidar to harvest credentials from infected employee devices.
Lumma Stealer activity resurged beginning the week of October 20, 2025, with new C&C browser-fingerprinting behavior. It injects from MicrosoftEdgeUpdate.exe into chrome.exe and contacts /api/set_agent endpoints to collect and exfiltrate browser and system fingerprints.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
1,810 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information stealer identified as associated with the campaign's apparent credential- and cryptocurrency-theft objectives. The article also cites Microsoft's takedown of Lumma malicious domains as background on infostealer infrastructure resilience.
Identified as an example of an information-stealing payload that users can be tricked into executing through ClickFix prompts and obfuscated PowerShell commands. The article provides no family-specific technical details.
Mentioned only as a comparison for Remus Stealer. The reference does not establish Lumma's participation in the analyzed campaign or describe its capabilities separately.
Mentioned only as background explaining customer distrust of malware-as-a-service stealers. The article supplies no technical details or operational relationship between Lumma and Warden.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.