Lumma Stealer
Was ist Lumma Stealer?
Lumma StealerA subscription-priced Russian-speaking malware-as-a-service info-stealer that emerged in 2022 and became one of the top-three stealers worldwide by 2024, distributed primarily via ClickFix lures and crack sites.
Lumma Stealer (also called LummaC2) is a C-language Windows info-stealer first observed in mid-2022 and rented out as malware-as-a-service in Russian-speaking criminal forums. By 2024 it had become one of the dominant info-stealers worldwide alongside RedLine and StealC, having largely filled the vacuum left by RedLine and Raccoon takedowns. Capabilities are typical of the category: theft of browser cookies, saved passwords, autofill data, crypto-wallet files, Discord and Telegram tokens, Steam sessions, and arbitrary files matched against operator-supplied patterns. Lumma is widely distributed via ClickFix fake-CAPTCHA lures, malicious cracks and YouTube tutorials, malvertising, and SEO-poisoned download sites. The 2024–2025 operator added GenAI-powered command-and-control obfuscation and bundled a loader stage for follow-on payloads such as ransomware. In May 2025 Microsoft Digital Crimes Unit, the U.S. DOJ, Cloudflare, ESET and Europol jointly disrupted Lumma's infrastructure (Operation Endgame), seizing roughly 2,300 domains and disrupting the storefront, though the actor's panel and forks resurfaced within weeks.
● Beispiele
- 01
A user clicks a fake reCAPTCHA, pastes the offered PowerShell into Run, and a Lumma loader stages the stealer that exfiltrates browser cookies within minutes.
- 02
Operation Endgame's May 2025 takedown sinkholes ~2,300 Lumma domains, briefly collapsing the storefront before clones return on bulletproof hosting.
● Häufige Fragen
Was ist Lumma Stealer?
A subscription-priced Russian-speaking malware-as-a-service info-stealer that emerged in 2022 and became one of the top-three stealers worldwide by 2024, distributed primarily via ClickFix lures and crack sites. Es gehört zur Kategorie Schadsoftware der Cybersicherheit.
Was bedeutet Lumma Stealer?
A subscription-priced Russian-speaking malware-as-a-service info-stealer that emerged in 2022 and became one of the top-three stealers worldwide by 2024, distributed primarily via ClickFix lures and crack sites.
Wie funktioniert Lumma Stealer?
Lumma Stealer (also called LummaC2) is a C-language Windows info-stealer first observed in mid-2022 and rented out as malware-as-a-service in Russian-speaking criminal forums. By 2024 it had become one of the dominant info-stealers worldwide alongside RedLine and StealC, having largely filled the vacuum left by RedLine and Raccoon takedowns. Capabilities are typical of the category: theft of browser cookies, saved passwords, autofill data, crypto-wallet files, Discord and Telegram tokens, Steam sessions, and arbitrary files matched against operator-supplied patterns. Lumma is widely distributed via ClickFix fake-CAPTCHA lures, malicious cracks and YouTube tutorials, malvertising, and SEO-poisoned download sites. The 2024–2025 operator added GenAI-powered command-and-control obfuscation and bundled a loader stage for follow-on payloads such as ransomware. In May 2025 Microsoft Digital Crimes Unit, the U.S. DOJ, Cloudflare, ESET and Europol jointly disrupted Lumma's infrastructure (Operation Endgame), seizing roughly 2,300 domains and disrupting the storefront, though the actor's panel and forks resurfaced within weeks.
Wie schützt man sich gegen Lumma Stealer?
Schutzmaßnahmen gegen Lumma Stealer kombinieren typischerweise technische Kontrollen und operative Praktiken, wie in der Definition oben beschrieben.
Welche anderen Bezeichnungen gibt es für Lumma Stealer?
Übliche alternative Bezeichnungen: LummaC2, Lumma.
● Verwandte Begriffe
- malware№ 591
Info-Stealer
Schadsoftware, die Zugangsdaten, Cookies, Tokens, Krypto-Wallets und andere sensible Daten von einem infizierten Gerät erbeutet und an den Angreifer überträgt.
- attacks№ 199
ClickFix Attack
A 2024-vintage social-engineering lure that displays a fake CAPTCHA, error dialog, or 'verify you're human' page instructing the victim to paste a pre-copied PowerShell command into Run, delivering info-stealers or loaders.
- malware№ 254
Credential-Stealer
Schadsoftware, die gezielt Passwörter, Hashes und Authentifizierungstoken aus einem infizierten System oder dessen Speicher extrahiert.
- malware№ 1014
RedLine Stealer
A subscription Windows info-stealer that dominated 2020–2023 cybercrime markets, harvesting browser secrets, crypto wallets, and FTP/VPN credentials; its infrastructure was disrupted by Operation Magnus in October 2024.
- malware№ 1329
Vidar Stealer
A long-running C++ Windows info-stealer derived from the older Arkei family, active since 2018 and still distributed in 2024–2025 via cracks, malvertising, and ClickFix lures.
- attacks№ 720
Malvertising
Missbrauch von Online-Werbenetzwerken, um Schadsoftware, Exploits oder Betrug über scheinbar legitime Anzeigen auf vertrauenswürdigen Websites zu verbreiten.
● Siehe auch
- № 998Raccoon Stealer