RAT / stealerATT&CK S1213
Lumma Stealer
Also known as: LummaC2, LummaStealer
Lumma Stealer, also called LummaC2, is an information stealer sold as malware-as-a-service that grew into one of the most used stealers. In May 2025 Microsoft's Digital Crimes Unit and the US Department of Justice, with international partners, seized domains used to run it, and CISA and the FBI published a joint advisory.
- Public attribution and associated actors
- Sold as malware-as-a-service to many criminal customers.
- First seen
- Around 2022
- Platforms
- Windows
- MITRE ATT&CK software entries
- S1213 Lumma Stealer
Status: About 2,300 domains seized or taken down in May 2025 in an action led by Microsoft's Digital Crimes Unit with the US Department of Justice and international partners (reported by Microsoft).
How it spreads or gets in
- Phishing links, malicious advertising, fake software downloads and fake CAPTCHA pages that trick users into running commands.
Key behaviours
- Stole browser credentials, cookies and cryptocurrency wallet data.
- Ran scripts through signed Windows binaries such as mshta.
- Sent collected data to its command servers.
ATT&CK techniques
- T1566.002Phishing: Spearphishing Link
- T1204.002User Execution: Malicious File
- T1218.005System Binary Proxy Execution: Mshta
- T1059.001Command and Scripting Interpreter: PowerShell
- T1555.003Credentials from Password Stores: Credentials from Web Browsers
- T1539Steal Web Session Cookie
- T1041Exfiltration Over C2 Channel
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Alert on mshta or PowerShell launched from the Run dialog or by a browser.
- Detect non-browser processes reading browser credential and cookie stores.
- Watch for session-cookie reuse from new devices.
Defences that work
- Teach users that real CAPTCHA checks never ask them to paste commands.
- Restrict mshta and script hosts with application control.
- Use phishing-resistant MFA and short session lifetimes.