Lumma StealerMalware
- LummaC2 stealer
- LummaStealer
Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma".From MISP Galaxy
Last reported 3 days ago, by Huntress22 reports
ATT&CK techniques
6 of 86 · each with the sentence it comes from- T1684Social Engineering
“…hat has already struck at least three Huntress customers, a threat actor using paid search results led victims into ClickFix-style social engineering that, as is usually the case, prompts the victims to run a command in their terminal.”
- T1195Supply Chain Compromise
“T1195”
- T1036Masquerading
“T1036”
- T1176.001Browser Extensions
“REVSTEALER targets browser credentials and cookies, cryptocurrency wallets, and browser extensions.”
- T1020Automated Exfiltration
“T1020”
- T1053.005Scheduled Task
“…ses a legitimate, Canon-signed application to sideload malicious code, then sets up two persistence mechanisms, a User Run key and a scheduled task, both named Canon Configuration Reader.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
22 reports · the newest 20, newest first · the exact sentence from each-
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware“…ple payloads dropped, including a pirated copy of the NetSupport Client remote monitoring and management (RMM) tool and a version of Lumma Stealer.”
-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“…lumen como AgentTesla, Formbook y SnakeStealer, coexistiendo con el avance de variantes modernas optimizadas para evasión como LummaStealer y Rhadamanthys.”
-
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix“It's also not new: a 2025 Lumma Stealer campaign stuffed its payloads into .wav, .mp3, .png and .mp4 files behind a PureCrypter layer, and WAV-hidden payloads are an Octowave Loader trademark.”
-
Panorama de amenazas digitales en México: qué cambió en el primer semestre de 2026“…radicionales como AgentTesla (0,95% nacional) y Formbook (0,26%), complementadas por la presencia de variantes evasivas modernas como LummaStealer y Rhadamanthys.”
-
REVSTEALER ramps up: analysis of up-and-coming infostealer“Widespread use of VMProtect packer in most REVSTEALER samples; unpacked samples display a verification prompt similar to LummaStealer and AuraStealer”
-
AiTM Phishing Becomes Top Initial Access Threat to Law Firms“Infostealers made up 30.4% of malware observed, led by Lumma Stealer at 9.6%.”
-
ESET participa en la Operación Endgame para interrumpir la botnet Amadey y el infostealer Stealc“…mó parte de dos grandes operaciones que interrumpieron algunas de las principales operaciones cibercriminales de ese momento, Lumma Stealer y Danabot.”
-
ESET takes part in Operation Endgame to disrupt Amadey and Stealc“A year ago, ESET Research was part of two major operations that disrupted some of the leading cybercriminal operations at the time, Lumma Stealer and Danabot.”
-
Interlock Ransomware: Evolving Under the Radar with ClickFix“The toolset spans a PowerShell backdoor, a custom RAT, and stealers like LummaStealer and BerserkStealer, all custom-packed.”
-
ClearFake's Variant: Web3 Exploitation for Malware Delivery“The chain leads to Emmenhtal Loader dropping Lumma Stealer, with Vidar Stealer also observed in January 2025.”
-
ClickFix tactic: The Phantom Meet Infostealer Campaign“Additionally, the GitHub issues campaign mainly targeted developers to spread Lumma Stealer by falsely reporting security vulnerabilities, thereby impacting thousands of public code repositories and exploiting developers’ trust in GitHub notifications.”
-
The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables“Key corrections: the initial compromise occurred in February 2026 (not June 2024), the initial access vector was Lumma Stealer malware (not an unknown mechanism), the dwell time was approximately two months (not 22 months), and the impact was scoped to teams whose access was dire…”
-
Panorama infostealer: cambios globales y casos destacados en México y Brasil“El análisis retrospectivo de 2025 revela nuevas familias, mayor sofisticación y dos hitos regionales: la campaña masiva de Lumma Stealer en México y el fraude NFC identificado en Brasil.”
-
Your personal information is on the dark web. What happens next?“It has become incredibly popular thanks to “as-a-service” kits like RedLine and Lumma Stealer.”
-
ESET Threat Report H2 2025“After its global disruption in May, Lumma Stealer managed to briefly resurface – twice – but its glory days are most likely over.”
-
Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics“Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics”
-
Top Cyber Threat Trends of 2025: Deepfakes, ClickFix & More“Seems simple enough, but since the original concept of ClickFix was uncovered in 2024–being used in LummaStealer infostealer attacks–threat actors have found a surprising amount of success in the technique.”
-
Infostealers Crash Course: A Tradecraft Tuesday Recap“More recently, in May, Europol announced a law enforcement operation targeting Lumma Stealer, which disrupted its technical infrastructure with federal authorities seizing its infrastructure and control panel.”
-
ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims“The Center for Internet Security has tracked ClickFix campaigns delivering Lumma Stealer against United States state and local government networks.”
-
RansomHub ransomware-as-a-service“From the Incident Response cases Group-IB experts confirmed that accounts have been acquired via LummaC2 stealer.”
Indicators in its reports
named in the reports above- flare[.]ioin 2 reports
- sites.google[.]comin 2 reports
Copy these 2 indicators · defanged
Thanks — we review every report.