Skip to content
vuxep.Let’s talk
INFOSTEALER GUIDE

What is Lumma Stealer? A guide for security teams.

Lumma Stealer, also called LummaC2, is information-stealing malware for Windows that first appeared for sale on Russian-language cybercriminal forums in 2022 [3]. It is sold as malware-as-a-service: affiliates pay for access to a panel that builds the malware and manages stolen data, and Microsoft tracks the developer and operator as Storm-2477 [7]. Microsoft described it as the favored infostealer of hundreds of threat actors, including the ransomware-linked group Octo Tempest (Scattered Spider), with targets spanning education, manufacturing, telecommunications, logistics, finance and healthcare [2].

If an employee was infected Monitor stealer-log exposure
BACKGROUND

How Lumma Stealer operates.

In May 2025, the US Department of Justice seized five domains hosting LummaC2 user panels, and Microsoft's Digital Crimes Unit obtained a court order to take down about 2,300 malicious domains, with Europol and Japan's JC3 acting on local infrastructure [1] [2]. The FBI said it had identified at least 1.7 million instances of LummaC2 being used to steal data, and Microsoft identified more than 394,000 infected Windows computers between March 16 and May 16, 2025 [1] [2]. Trend Micro reported that Lumma's infrastructure ramped back up within weeks [4]. A doxxing campaign against alleged operators from late August to early October 2025 coincided with a sharp decline in activity [5], but Bitdefender reported that operations had scaled up again between December 2025 and January 2026 [6].

01 / WHAT IT TAKES

What Lumma Stealer steals.

  • Saved browser passwords from Chromium-based browsers (including Chrome and Edge) and Gecko-based browsers such as Firefox [7]
  • Browser session cookies and autofill data [7]
  • Email and banking login credentials [1]
  • Credit card and bank account details [2]
  • Cryptocurrency wallets, wallet extensions and seed phrases [1] [7]
  • Two-factor authentication extensions and MFA details [3] [6]
  • VPN configuration files plus email, FTP and messaging client data [7]
  • Documents from the user profile and system details used to profile the victim [7]
02 / HOW IT ARRIVES

How it spreads.

  • Fake CAPTCHA or verification pages (ClickFix) that trick users into pasting a command into the Windows Run dialog [3] [4]
  • Phishing emails that impersonate trusted brands, including a Booking.com-themed campaign in March 2025 [2] [7]
  • Malvertising and search ads that lead to fake software downloads [7] [8]
  • Cracked software, fake game cheats and keygens promoted through GitHub, YouTube and Facebook [4]
  • Delivery by loaders and other malware, including CastleLoader [6] [7]
03 / TIMELINE

Notable events.

  1. LummaC2 first appears for sale on Russian-language cybercriminal forums [3].

  2. The DOJ seizes five LummaC2 panel domains (May 19-21), Microsoft takes down about 2,300 domains under a court order, and CISA and the FBI publish advisory AA25-141B [1] [2] [3].

  3. Trend Micro reports that Lumma's infrastructure ramped back up within weeks of the takedown [4].

  4. After a doxxing campaign against alleged operators, Lumma's operator accounts are reportedly compromised on September 17 and activity declines [5].

  5. Bitdefender reports Lumma operations scaled significantly between December 2025 and January 2026, often delivered via CastleLoader [6].

  6. Microsoft reports Lumma among the payloads of an AI-themed malvertising campaign run by the access broker Storm-3075 [8].

INCIDENT RESPONSE

If an employee device was infected.

Stolen session cookies can let an attacker skip passwords and MFA, so a password reset alone is not enough.

  1. Isolate the infected device from the network and reimage it rather than relying only on malware removal, since the data has likely already been exfiltrated.
  2. Treat every credential saved in any browser or password store on that device as compromised, and reset them from a clean device, starting with email, SSO, VPN, cloud admin and finance accounts.
  3. Revoke active sessions and refresh tokens for the user in your identity provider and key SaaS apps; stolen session cookies can let attackers bypass MFA without the password.
  4. Review sign-in logs for the affected accounts since the estimated infection date, looking for new devices, unusual locations, new MFA methods, mailbox rules and OAuth app consents.
  5. Rotate any API keys, SSH keys, VPN profiles and cloud credentials that were stored on or used from the device.
  6. Ask whether the employee used a personal or shared device for work, and apply the same resets to any work accounts accessed from it.
  7. Move high-value accounts to phishing-resistant MFA and restrict unapproved software, as recommended in CISA advisory AA25-141B [3].
COMMON QUESTIONS

Lumma Stealer,
answered.

How Vuxep monitors stealer logs

Is Lumma Stealer still active?

Yes, according to researchers. Trend Micro reported that Lumma rebuilt within weeks of the May 2025 takedown, Bitdefender reported large-scale activity in December 2025 and January 2026, and Microsoft documented it in malvertising campaigns in 2026 [4] [6] [8]. Its activity did drop in September 2025 after alleged operators were doxxed [5].

Can Lumma steal passwords saved in Chrome?

Yes. Microsoft reports that Lumma collects saved passwords, session cookies and autofill data from Chromium-based browsers, which include Chrome and Edge, as well as from Firefox and other Gecko-based browsers [7].

Does antivirus detect Lumma Stealer?

Not reliably on its own. Microsoft says Lumma can be programmed to bypass certain security defenses, and CISA warns that antivirus may miss obfuscated executables, recommending application allowlisting and behavioral monitoring as well [2] [3].

Does MFA protect accounts from Lumma?

Not fully. Lumma steals session cookies and MFA-related data, which can let attackers reuse an already-authenticated session [3] [7]. After an infection, revoke sessions as well as resetting passwords, and prefer phishing-resistant MFA [3].

CHECK THE ORIGINAL SOURCES

Research behind this guide.

By the Vuxep team. Reviewed October 19, 2026. Products, plans, and threat activity change; check the original source for current details.

  1. U.S. Department of Justice: Justice Department Seizes Domains Behind Major Information-Stealing Malware Operation (May 21, 2025)
  2. Microsoft On the Issues: Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool (May 21, 2025)
  3. CISA and FBI Advisory AA25-141B: Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations (May 21, 2025)
  4. Trend Micro: Lumma Stealer Returns (July 22, 2025)
  5. Trend Micro: Shifts in the Underground: The Impact of Water Kurita's (Lumma Stealer) Doxxing (October 16, 2025)
  6. Bitdefender Labs: LummaStealer Is Getting a Second Life Alongside CastleLoader (February 11, 2026)
  7. Microsoft Security Blog: Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer (May 21, 2025)
  8. Microsoft Security Blog: AI brands as bait: How threat actors are using the AI hype in social engineering (June 8, 2026)
OTHER INFOSTEALERS

Compare infostealer families.

What is RedLine Stealer?What is Vidar Stealer?What is StealC?What is Raccoon Stealer?Stealer logs vs. breach data
YOUR DOMAINS. YOUR TEAM.

Find stolen work
credentials first.

Vuxep indexes credentials from stealer logs and alerts your team when accounts on your verified domains appear. See the workflow in a walkthrough.

Book a Vuxep walkthrough