S1213 - Lumma Stealer

Lumma Stealer is a Malware-as-a-Service (MaaS) infostealer that targets Windows systems to steal sensitive data such as passwords, crypto wallets, and 2FA tokens. It spreads through phishing, fake downloads, and malicious websites, allowing attackers to collect and sell stolen information or use it to deploy other malware.

Author
agomez
Created
2025-10-17 10:07:08
Last updated
2026-02-07 19:06:53
Downloads
38329
IPv4 indicators
3
Hostname indicators
1222
URL indicators
739
Sample indicators
1316

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

https://zestmodp.top/zeda URL

modified 2026-09-21 14:01:13
Lumma Stealer (ThreatFox Abuse.ch) · Lumma stealer (Maltiverse Threat Observatory)

zestmodp.top Hostname

modified 2026-09-21 14:01:13
Lumma Stealer (ThreatFox Abuse.ch) · credentialflusher (Maltiverse Threat Observatory) · Lumma stealer (Maltiverse Threat Observatory)

holiday-forever.cc Hostname

modified 2026-09-21 13:49:34
Generic Malware (Maltiverse Threat Observatory) · Lumma stealer (Maltiverse Threat Observatory) · win.count.loader (Maltiverse Threat Observatory)

msedge.vg Hostname

modified 2026-09-21 13:49:28
Malicious behavior (Maltiverse Threat Observatory) · Lumma stealer (Maltiverse Threat Observatory) · win.count.loader (Maltiverse Threat Observatory)

msgrouppolicy.vg Hostname

modified 2026-09-21 13:49:23
Exploit.Kitmalware (Maltiverse Threat Observatory) · Smokeloader (Maltiverse Threat Observatory) · Malicious behavior (Maltiverse Threat Observatory) · Lumma stealer (Maltiverse Threat Observatory) · win.count.loader (Maltiverse Threat Observatory)

craveinjuur.shop Hostname

modified 2026-09-21 13:44:18
Lumma Stealer (ThreatFox Abuse.ch)

parent-control.cc Hostname

modified 2026-09-21 13:44:17
Lumma stealer (Maltiverse Threat Observatory) · win.count.loader (Maltiverse Threat Observatory)

microservice.gl Hostname

modified 2026-09-21 13:44:16
Generic Malware (Maltiverse Threat Observatory) · Lumma stealer (Maltiverse Threat Observatory)

globalprotextetx.cc Hostname

modified 2026-09-21 13:42:30
Lumma stealer (Maltiverse Threat Observatory)

some-othertag.cc Hostname

modified 2026-09-21 13:29:48
Generic Malware (Maltiverse Threat Observatory) · Lumma stealer (Maltiverse Threat Observatory)

bakedstusteeb.shop Hostname

modified 2026-09-21 13:23:49
Lumma Stealer (ThreatFox Abuse.ch)

acio-patron.cc Hostname

modified 2026-09-21 13:10:09
Malicious behavior (Maltiverse Threat Observatory) · Generic Malware (Maltiverse Threat Observatory) · Lumma stealer (Maltiverse Threat Observatory)

https://nighetwhisper.top/lekd URL

modified 2026-09-21 13:06:38
Lumma Stealer (ThreatFox Abuse.ch) · Lumma stealer (Maltiverse Threat Observatory)

nighetwhisper.top Hostname

modified 2026-09-21 13:06:38
Lumma Stealer (ThreatFox Abuse.ch) · Malicious.behaviour (Maltiverse Threat Observatory) · Lumma stealer (Maltiverse Threat Observatory)

1e75e019d87807fe63a3a5f6f9147af7289d2da288e7a5655743379d89fe76fe Sample

modified 2026-09-21 12:55:49
Lumma Stealer (ThreatFox Abuse.ch) · Generic Malware (Hybrid-Analysis)

pinkipinevazzey.pw Hostname

modified 2026-09-21 12:40:01
Lumma Stealer (ThreatFox Abuse.ch)

jealousslotoykwo.xyz Hostname

modified 2026-09-21 12:40:00
Lumma Stealer (ThreatFox Abuse.ch)

averageaattractiionsl.shop Hostname

modified 2026-09-21 12:40:00
Lumma Stealer (ThreatFox Abuse.ch)

araucahkbm.live Hostname

modified 2026-09-21 12:39:55
Lumma Stealer (ThreatFox Abuse.ch) · Phishing (OpenPhish)

smallelementyjdui.shop Hostname

modified 2026-09-21 12:39:51
Lumma Stealer (ThreatFox Abuse.ch)

indoeconw.live Hostname

modified 2026-09-21 12:39:47
Lumma Stealer (ThreatFox Abuse.ch)

dynamiczl.live Hostname

modified 2026-09-21 12:39:47
Lumma Stealer (ThreatFox Abuse.ch)

psychozc.cyou Hostname

modified 2026-09-21 12:39:46
Lumma stealer (Maltiverse Threat Observatory)

doughtdrillyksow.shop Hostname

modified 2026-09-21 12:39:42
Lumma Stealer (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

online-access.live Hostname

modified 2026-09-21 12:39:42
Lumma Stealer (ThreatFox Abuse.ch)

marrueye.cyou Hostname

modified 2026-09-21 12:39:38
Lumma Stealer (ThreatFox Abuse.ch)

peepburry828.sbs Hostname

modified 2026-09-21 12:39:38
Lumma Stealer (ThreatFox Abuse.ch)

agentgrabber.com Hostname

modified 2026-09-21 12:39:32
Lumma Stealer (ThreatFox Abuse.ch)

claimconcessionrebe.shop Hostname

modified 2026-09-21 12:39:23
Lumma Stealer (ThreatFox Abuse.ch)

fairytalesw.run Hostname

modified 2026-09-21 12:39:22
Lumma Stealer (ThreatFox Abuse.ch)

lemonwsljq.live Hostname

modified 2026-09-21 12:39:22
Lumma Stealer (ThreatFox Abuse.ch)

whispedwoodmoodsksl.shop Hostname

modified 2026-09-21 12:39:22
Lumma Stealer (ThreatFox Abuse.ch)

marathonbeedksow.shop Hostname

modified 2026-09-21 12:39:22
Lumma Stealer (ThreatFox Abuse.ch)

releaswrlf.run Hostname

modified 2026-09-21 12:39:22
Lumma Stealer (ThreatFox Abuse.ch)

candidatersz.cyou Hostname

modified 2026-09-21 12:39:15
Lumma Stealer (ThreatFox Abuse.ch)

weldorae.digital Hostname

modified 2026-09-21 12:39:15
Lumma Stealer (ThreatFox Abuse.ch)

castmaxw.run Hostname

modified 2026-09-21 12:39:15
Lumma Stealer (ThreatFox Abuse.ch)

odovakmc.cyou Hostname

modified 2026-09-21 12:39:15
Lumma Stealer (ThreatFox Abuse.ch)

demhjmr.cyou Hostname

modified 2026-09-21 12:39:15
Lumma stealer (Maltiverse Threat Observatory)

smeltingt.run Hostname

modified 2026-09-21 12:39:10
Lumma Stealer (ThreatFox Abuse.ch)

equatorf.run Hostname

modified 2026-09-21 12:39:08
Lumma Stealer (ThreatFox Abuse.ch)

milldymarskwom.shop Hostname

modified 2026-09-21 12:39:08
Lumma Stealer (ThreatFox Abuse.ch)

webex-download.com Hostname

modified 2026-09-21 12:39:08
Lumma Stealer (ThreatFox Abuse.ch)

nervepianoyo.sbs Hostname

modified 2026-09-21 12:38:50
Lumma Stealer (ThreatFox Abuse.ch)

bytehorizon.cc Hostname

modified 2026-09-21 12:38:32
Lumma stealer (Maltiverse Threat Observatory)

probaforum22.forum24.ru Hostname

modified 2026-09-21 12:38:19
Lumma Stealer (ThreatFox Abuse.ch)

actomil.cyou Hostname

modified 2026-09-21 12:38:04
Lumma Stealer (ThreatFox Abuse.ch)

lonylexpedn.my Hostname

modified 2026-09-21 12:38:04
Lumma Stealer (ThreatFox Abuse.ch)

pillowcxloud.world Hostname

modified 2026-09-21 12:38:04
Lumma Stealer (ThreatFox Abuse.ch)

museumtespaceorsp.shop Hostname

modified 2026-09-21 12:38:04
Lumma Stealer (ThreatFox Abuse.ch)

upknittsoappz.shop Hostname

modified 2026-09-21 12:38:04
Lumma Stealer (ThreatFox Abuse.ch)

optifyc.live Hostname

modified 2026-09-21 12:37:54
Lumma Stealer (ThreatFox Abuse.ch)

rebuildhurrte.com Hostname

modified 2026-09-21 12:37:43
Lumma Stealer (ThreatFox Abuse.ch) · Lumma stealer (Maltiverse Threat Observatory)

netgizmow.live Hostname

modified 2026-09-21 12:37:19
Lumma Stealer (ThreatFox Abuse.ch)

brownieyuz.sbs Hostname

modified 2026-09-21 12:37:18
Lumma Stealer (ThreatFox Abuse.ch)

octanzn.bet Hostname

modified 2026-09-21 12:37:13
Lumma Stealer (ThreatFox Abuse.ch)

consciouosoepewmausj.site Hostname

modified 2026-09-21 12:37:13
Lumma Stealer (ThreatFox Abuse.ch)

pholith.cyou Hostname

modified 2026-09-21 12:36:54
Lumma Stealer (ThreatFox Abuse.ch)

latyoutw.cyou Hostname

modified 2026-09-21 12:36:54
Lumma Stealer (ThreatFox Abuse.ch)

carstirgapcheatdeposwte.pw Hostname

modified 2026-09-21 12:36:54
Malicious URL (Hybrid-Analysis) · Lumma Stealer (ThreatFox Abuse.ch)

explorebieology.run Hostname

modified 2026-09-21 12:36:54
Lumma Stealer (ThreatFox Abuse.ch)

falsifydisappearsoaeka.pw Hostname

modified 2026-09-21 12:36:52
Lumma Stealer (ThreatFox Abuse.ch)

snipersecrets.world Hostname

modified 2026-09-21 12:36:51
Lumma Stealer (ThreatFox Abuse.ch)

rapeflowwj.lat Hostname

modified 2026-09-21 12:36:46
Lumma Stealer (ThreatFox Abuse.ch)

ducksringjk.sbs Hostname

modified 2026-09-21 12:36:46
Lumma Stealer (ThreatFox Abuse.ch)

miniaturefinerninewjs.shop Hostname

modified 2026-09-21 12:36:45
Lumma Stealer (ThreatFox Abuse.ch)

jinga.locker Hostname

modified 2026-09-21 12:36:16
Lumma Stealer (ThreatFox Abuse.ch)

thuqxer.cyou Hostname

modified 2026-09-21 12:36:16
Lumma stealer (Maltiverse Threat Observatory)

classyhelped.net Hostname

modified 2026-09-21 12:36:15
Lumma Stealer (ThreatFox Abuse.ch)

tacticaltalks.live Hostname

modified 2026-09-21 12:36:15
Lumma Stealer (ThreatFox Abuse.ch)

slowdomkaf.run Hostname

modified 2026-09-21 12:36:15
Lumma Stealer (ThreatFox Abuse.ch)

maiantfuuk.run Hostname

modified 2026-09-21 12:36:15
Lumma Stealer (ThreatFox Abuse.ch)

sneg.cc Hostname

modified 2026-09-21 12:35:50
Lumma Stealer (ThreatFox Abuse.ch)

perfomnjshin.cyou Hostname

modified 2026-09-21 12:35:48
Lumma Stealer (ThreatFox Abuse.ch)

languagedscie.shop Hostname

modified 2026-09-21 12:35:48
Lumma Stealer (ThreatFox Abuse.ch)

fragnantbui.shop Hostname

modified 2026-09-21 12:35:23
Lumma Stealer (ThreatFox Abuse.ch)

facilitycoursedw.shop Hostname

modified 2026-09-21 12:35:21
Lumma Stealer (ThreatFox Abuse.ch) · SmokeLoader (ThreatFox Abuse.ch)

latchclan.shop Hostname

modified 2026-09-21 12:35:18
Lumma Stealer (ThreatFox Abuse.ch)

metrkio.shop Hostname

modified 2026-09-21 12:35:18
Lumma stealer (Maltiverse Threat Observatory)

gdpfsj.com Hostname

modified 2026-09-21 12:35:18
Lumma Stealer (ThreatFox Abuse.ch)

queuedbyn.cyou Hostname

modified 2026-09-21 12:35:18
Lumma Stealer (ThreatFox Abuse.ch)

climepunneddus.com Hostname

modified 2026-09-21 12:35:17
Lumma Stealer (ThreatFox Abuse.ch)

dsimensio.bet Hostname

modified 2026-09-21 12:35:17
Lumma Stealer (ThreatFox Abuse.ch)

drinnkysoapmzv.shop Hostname

modified 2026-09-21 12:35:17
Lumma Stealer (ThreatFox Abuse.ch)

coldshpwyb.run Hostname

modified 2026-09-21 12:35:17
Lumma Stealer (ThreatFox Abuse.ch)

legislationdictater.mom Hostname

modified 2026-09-21 12:34:58
Lumma Stealer (ThreatFox Abuse.ch)

coursedonnyre.shop Hostname

modified 2026-09-21 12:34:57
Lumma Stealer (ThreatFox Abuse.ch)

hackergala.digital Hostname

modified 2026-09-21 12:34:33
Lumma Stealer (ThreatFox Abuse.ch)

maloneyr.cyou Hostname

modified 2026-09-21 12:34:32
Lumma stealer (Maltiverse Threat Observatory) · CountLoader (ThreatFox Abuse.ch)

improvxf.run Hostname

modified 2026-09-21 12:34:30
Lumma Stealer (ThreatFox Abuse.ch)

yashnei.cyou Hostname

modified 2026-09-21 12:34:29
Lumma stealer (Maltiverse Threat Observatory)

kinyqxr.cyou Hostname

modified 2026-09-21 12:34:29
Lumma stealer (Maltiverse Threat Observatory)

observerfry.lat Hostname

modified 2026-09-21 12:34:25
Lumma Stealer (ThreatFox Abuse.ch)

webpointsl.run Hostname

modified 2026-09-21 12:34:17
Lumma Stealer (ThreatFox Abuse.ch)

modteamo.live Hostname

modified 2026-09-21 12:34:17
Lumma Stealer (ThreatFox Abuse.ch)

ripe-blade.cyou Hostname

modified 2026-09-21 12:34:11
Lumma Stealer (ThreatFox Abuse.ch)

programmbox.xyz Hostname

modified 2026-09-21 12:34:01
Lumma Stealer (ThreatFox Abuse.ch)

hyperforge.digital Hostname

modified 2026-09-21 12:33:59
Lumma Stealer (ThreatFox Abuse.ch)

dilemmadu.site Hostname

modified 2026-09-21 12:33:59
Lumma Stealer (ThreatFox Abuse.ch) · Generic Malware (Maltiverse Threat Observatory) · Malicious behavior (Maltiverse Threat Observatory)

authorisev.site Hostname

modified 2026-09-21 12:33:59
Lumma Stealer (ThreatFox Abuse.ch) · Generic Malware (Maltiverse Threat Observatory)