Lumma Stealer

MITRE ATT&CK: S1213 View on attack.mitre.org

Aliases: LummaStealer, LummaC2 Stealer, Lumma Stealer

First seen
2022-01-01 00:00:00
Malware type
credential-stealer, spyware
Family
Malware family
Operating systems
windows
Related IoCs
12427 (11535 malicious)
Last IoC activity
2026-10-18 04:26:52
Profile updated
2026-07-07 13:13:44

Targeted industries: financial-services technology-and-telecommunications retail-and-hospitality

Context

Lumma Stealer is an information stealer malware family in use since at least 2022. Lumma Stealer is a Malware as a Service (MaaS) where captured data has been sold in criminal markets to Initial Access Brokers.

Recent IoC activity

11,538 malicious indicators in Maltiverse are attributed to Lumma Stealer (S1213). The 20 most recently updated:

TypeIndicatorUpdatedSources
hostname ultahost.gl 2026-10-18 2
file sample e45d149081b2f65cee27d6a038afe1ff9b5c89382a935deadc6faf7c45d2f215 2026-10-18 1
hostname meiddlesrsnzop.shop 2026-10-18 1
hostname fraggielek.biz 2026-10-18 1
hostname techchaiun.live 2026-10-18 1
hostname soarxvc.run 2026-10-18 1
hostname sofaprivateawarderysj.shop 2026-10-18 1
hostname buttockdecarderwiso.shop 2026-10-18 1
hostname flyxaway.live 2026-10-18 1
hostname aplointexhausdh.xyz 2026-10-18 1
hostname breuhiag.live 2026-10-18 1
hostname instiga.cyou 2026-10-18 1
hostname proggresinvj.cyou 2026-10-18 1
hostname worryfillvolcawoi.shop 2026-10-18 1
hostname gemcreedarticulateod.shop 2026-10-18 1
hostname raisezx.run 2026-10-18 1
hostname medicinebuckerrysa.pw 2026-10-18 1
hostname bardsyies.live 2026-10-18 1
hostname beerword.xyz 2026-10-18 1
hostname hopezx.run 2026-10-18 1

Detection coverage

  • 2 YARA rules
  • 737 Sigma rules

Malware & tools used

  • Debugger Evasion (attack-pattern)
  • AutoHotKey & AutoIT (attack-pattern)
  • Supply Chain Compromise (attack-pattern)
  • Screen Capture (attack-pattern)
  • Credentials from Web Browsers (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Process Hollowing (attack-pattern)
  • Electron Applications (attack-pattern)
  • System Checks (attack-pattern)
  • Mshta (attack-pattern)
  • DLL (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Browser Extensions (attack-pattern)
  • Local Data Staging (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • User Execution (attack-pattern)
  • Masquerade File Type (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • PowerShell (attack-pattern)
  • Automated Collection (attack-pattern)
  • Reflective Code Loading (attack-pattern)
  • Malicious File (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)

Used by threat actors

  • Lumma Stealer Distribution via Spoofed Webpages (campaign)
  • November 2023-May 2025 Lumma Stealer Deployment Activity (campaign)
  • "Fake CAPTCHA" Lumma Stealer Distribution Campaign (campaign)

Exploited vulnerabilities

  • CVE-2024-21412 (vulnerability)

Detection rules

  • DITEKSHEN_MALWARE_Win_Unknown_Packedloader_01 (yara-rule)
  • RUSSIANPANDA_Lummac2 (yara-rule)

Reports & references

  • Trend Micro — Ai Assisted Fake Github Repositories (report)
  • Trend Micro — Lumma Stealer Returns (report)
  • Trend Micro — The Impact Of Water Kurita Lumma Stealer Doxxing (report)
  • Trend Micro — Lumma Stealer Browser Fingerprinting (report)
  • Microsoft — Octo Tempest Crosses Boundaries To Facilitate Extortion Encryption And Destruction (report)
  • proofpoint.com — Update Fake Updates Two New Actors And New Mac Malware (report)
  • info.spamhaus.com — Q4%202023%20Botnet%20Threat%20Update (report)
  • Kaspersky — 115663 (report)
  • cloud.google.com — Unc5537 Snowflake Data Theft Extortion (report)
  • proofpoint.com — Clipboard Compromise Powershell Self Pwn (report)
  • research.checkpoint.com — Stargazers Ghost Network (report)
  • blog.sekoia.io — Interlock Ransomware Evolving Under The Radar (report)
  • blog.sekoia.io — Exposing Fakebat Loader Distribution Methods And Adversary Infrastructure (report)
  • x.com — 1900460479778030013 (report)
  • group-ib.com — Clickfix The Social Engineering Technique Hackers Use To Manipulate Victims (report)
  • McAfee — Behind The Captcha A Clever Gateway Of Malware (report)
  • synthient.com — Ghostsocks From Initial Access To Residential Proxy (report)
  • infrawatch.app — Ghostsocks Lummas Partner In Proxy (report)
  • spycloud.com — Lummac2 Malware Stealthier Capabilities (report)
  • elastic.co — Ghostpulse Haunts Victims Using Defense Evasion Bag O Tricks (report)
  • trellix.com — How Attackers Repackaged A Threat Into Something That Looked Benign (report)
  • elastic.co — A Wretch Client (report)
  • resource.redcanary.com — 2025Threatdetectionreport Redcanary (report)
  • malware-traffic-analysis.net — Index (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Lumma (report)

External references