| Lumma Stealer | |
|---|---|
| Alias | LummaC2 |
| Authors | "Shamel" [1] |
| Technical details | |
| Written in | C++, ASM |
Lumma Stealer is an infostealer malware as a service program developed for Microsoft Windows.
Lumma Stealer is distributed by affiliates via a number of campaigns including phishing emails, malicious advertisements posing as legitimate downloads, and compromised websites. It is frequently associated with fake CAPTCHA pages, which prompt the user to paste a command into the run box. [2] It steals data from a number of programs including web browsers, crypto wallets and chat applications, as well as user files. [3] The exfiltrated data is sent to a number of hardcoded control servers, falling back to Telegram, Dropbox and Steam if the servers are unreachable. [4]
Lumma Stealer employs advanced obfuscation techniques, and uses process hollowing to impersonate legitimate programs for the purposes of evading detection. It delays detonation until a sufficent amount of human-like activity has occurred. [5] Instead of using WinAPI, it performs direct syscalls. [6]
Lumma is believed to have first originated on cybercrime forums in 2022. [7]
From March to May 2025, Microsoft identified 394,000 computers that were infected with Lumma. [8] In 2025, Lumma was the second most common sample uploaded to ANY.RUN, and the third on MalwareBazaar. [9] [10] In May 2025, Microsoft announced the seizure of 2,300 domains associated with Lumma through a vulnerability. [11] While Lumma has continued their operation, it is believed that this may have damaged their reputation. [12]