Credential-stealing MaaS: LummaC2 is a modular infostealer written in C that sells subscriptions through Russian-language forums and Telegram. LummaC2 targets credentials, cookies, wallet seeds and system identities, then sells the resulting “logs” to initial access brokers.
Technical evolution: LummaC2 uses in-memory execution and process hollowing, advanced sandbox detection, AMSI bypass and multilayered C2 fallback mechanisms. Opcodes allow granular theft and even self-deletion.
“ClickFix” lure: Fake CAPTCHA sites trick victims into copying a malicious PowerShell command from the clipboard into the Windows Run dialog. Additional LummaC2 channels include malvertising, GitHub abuse, gaming mods and spear phishing.
Marketplace status: LummaC2 was the most prevalent infostealer for most of 2025, but a May 2025 law enforcement takedown and continued disruption have sharply reduced its standing. ANY.RUN's Q4 2025 threat report recorded a 65% drop in Lumma detections, and independent research shows Vidar has led the Russian Market infostealer marketplace since November 2025. Rankings remain volatile and some researchers describe a partial LummaC2 recovery, so current standing should be read as a snapshot, not a fixed position.
Persistent resilience: After the May 2025 takedown, law enforcement seized five user-panel domains directly, and a separate, wider Microsoft-led action took down, suspended or blocked roughly 2,300 additional domains and disrupted numerous Telegram channels. LummaC2 reemerged in 2026 via CastleLoader and, reportedly, RenEngine loaders.
What is Lumma Stealer? Definition and MaaS model
LummaC2 is a modular information-stealing malware, written in C, distributed as malware-as-a-service (MaaS) through Russian-language cybercrime forums and Telegram channels. Rather than selling the malware outright, LummaC2's developers rent access through subscription tiers, letting affiliates run their own campaigns while the core team maintains the builder, command-and-control (C2) infrastructure and update cadence.
How does Lumma Stealer work? The LummaC2 attack lifecycle
LummaC2 follows a six-stage attack lifecycle from initial delivery through monetization.
Delivery and initial access: Affiliates distribute LummaC2 through fake CAPTCHA pages ("ClickFix"), malvertising, GitHub releases, game mods and spearphishing. Victims are tricked into executing a PowerShell command from the clipboard or downloading a trojanized installer.
Execution in memory: The LummaC2 payload runs entirely in memory, often via process hollowing into trusted binaries. It uses base64-encoded PowerShell one-liners, mshta.exe or malicious MSI / ISO files to execute scripts and download additional components.
Evasion: LummaC2 actively detects sandboxes by hashing system API responses and terminates if values match common emulator names. LummaC2 reportedly disables the Windows Anti-malware Scan Interface (AMSI) by removing the AmsiScanBuffer string from clr.dll and uses heavy packing and obfuscation.
Credential theft: LummaC2 collects data through a modular opcode system. Opcode 0 steals files and documents; opcodes 1 and 2 harvest browser credentials; opcode 3 downloads additional payloads. LummaC2 targets web browsers, cryptowallets, communication apps and system identifiers.
Exfiltration and C2 communication: Stolen data are packaged and transmitted via HTTP / HTTPS POST requests to a primary list of up to nine hard-coded domains. If these are blocked, LummaC2 fallback addresses are fetched from obfuscated Steam profiles or Telegram channels.
Cleanup and monetization: Depending on configuration, LummaC2 decodes and executes a self-delete opcode. Extracted logs are sold to initial access brokers who use them for credential stuffing, session hijacking and lateral movement or resell them to ransomware affiliates.
LummaC2 by the numbers: key statistics, 2024 to 2026
Metric
Documented value (time frame)
Evidence
Detection growth
369% increase in detections between the first and second halves of 2024.
DOJ takedown materials and Acronis TRU document explosive growth after new distribution techniques were introduced.
Infections (Q2 2025)
More than 394,000 infected Windows systems within a two-month window (March 16 to May 16, 2025).
Microsoft telemetry captured this spike; the FBI documented roughly 1.7 million instances of information theft.
Underground log listings
Thousands of LummaC2 logs listed on forums by mid-2024, a 71.7% year-over-year increase.
Illustrates the scale of the initial-access-broker credential economy.
Account compromise surge
389% year-over-year increase in account compromises during 2025, driven largely by LummaC2.
Shows the downstream impact on identity security.
Ransomware precursor rate
Infostealers like LummaC2 are a precursor to over 54% of ransomware attacks.
Logs enable double extortion and lateral movement.
Law enforcement disruption
In May 2025, authorities seized five user-panel domains directly; a separate, wider Microsoft-led action took down, suspended or blocked roughly 2,300 additional domains and disrupted numerous Telegram channels.
Domains were sinkholed to allow monitoring of remaining infections.
Resurgence (2026)
Distribution resumed through CastleLoader and RenEngine loaders in early 2026.
Operators rebuilt infrastructure and migrated to more resilient platforms.
How does the LummaC2 MaaS business model work?
LummaC2 is marketed through Russian-language forums and Telegram channels, lowering the barrier for would-be criminals. LummaC2 affiliates subscribe to different tiers that grant varying feature sets.
Pricing tier
Approx. cost (USD)
Features / access level
Basic
~$250 / month
Standard build with basic exfiltration and C2 panel access.
Professional
~$500 / month
Advanced features, improved detection evasion and priority support.
Corporate
~$1,000 / month
Multiuser support, infrastructure resilience and customization options.
Source code
~$20,000 (one time)
Full access to the LummaC2 source code for independent development and resale.
The LummaC2 service is supported by crypting services, bulletproof hosting and residential proxy plugins, ensuring affiliates can operate from the victim's geographic region and evade risk-based authentication.
What are LummaC2's technical capabilities?
In-memory and nonresident execution: LummaC2 runs entirely in memory, injecting its payload into trusted processes to avoid leaving a disk footprint.
Registry persistence: Newer LummaC2 variants optionally set registry run keys to survive reboot.
Anti-analysis and sandbox evasion: LummaC2 hashes API values returned by GetUserNameW and GetComputerNameW and terminates if they match known sandbox values. It also uses heavy packing and encryption to obfuscate its code and configuration.
AMSI bypass: LummaC2 reportedly removes the AmsiScanBuffer signature from clr.dll to blind the Windows Anti-malware Scan Interface.
Multilayered C2 fallback: A hard-coded list of up to nine domains behind Cloudflare proxies is used for primary LummaC2 exfiltration; when unreachable, fallback addresses are retrieved from obfuscated Steam profiles or Telegram channels.
Opcode-driven theft: a modular opcode system allows targeted theft of browser credentials, files, cryptowallets and more. One LummaC2 opcode triggers self-deletion, removing the malware after exfiltration to hinder forensic recovery.
How does ClickFix distribute Lumma Stealer?
The most successful LummaC2 campaigns use a fake CAPTCHA page. Victims are redirected to a "Verify you are human" prompt that instructs them to open the Windows Run dialog and paste clipboard contents. Prior to that, the page adds a base64-encoded PowerShell command that downloads and executes the LummaC2 payload. Because the command is run by the user, it bypasses browser-based defenses and many endpoint agents.
LummaC2 affiliates diversify distribution through:
Vector
Mechanism / lure
Target audience
Malvertising
Search-engine poisoning and ads for popular software such as "ChatGPT Desktop," "Vegas Pro" or "KMS Activator."
Users seeking cracked software or AI tools
GitHub abuse
Trojanized releases (for example, "Pictore.exe") hosted on GitHub’s legitimate infrastructure.
Developers and technical users who trust GitHub links
Gaming lures
Stealer hidden in game mods or automation scripts like "Hamster Kombat" or "Minecraft" mods.
Gamers and younger users with lower security awareness
Phishing / vishing
Spearphishing emails impersonating updates or shipping notifications, sometimes combined with voice calls.
Corporate employees, executives and finance departments
What data does LummaC2 target? The Lumma Stealer asset matrix
Category
Targets / data points
Impact
Web browsers
Chromium- and Gecko-based browsers (Chrome, Edge, Firefox, Opera, Brave); saved credentials, session cookies, autofill data and credit card information.
Credential theft enables account takeover and credit card fraud.
Cryptowallets
MetaMask, Phantom, Exodus, Binance and other browser-based wallets; local wallet files and seed phrases.
Direct theft of digital assets and cryptocurrency.
Applications
Tokens from Telegram, Discord, Steam, VPN clients and FTP clients.
Facilitates lateral movement, additional malware delivery and account takeover.
Identity / system
Usernames, computer names, IP addresses, user-agent strings and hardware IDs.
Victim fingerprinting for targeting and adaptive C2 operations.
Files / documents
Desktop files, user directories and specific file extensions (via opcode 0).
Theft of proprietary data and intellectual property.
How does LummaC2 lead to ransomware? The Lumma-ransomware nexus
LummaC2 is rarely the final objective. Stolen data is packaged into logs and sold on underground markets where initial access brokers purchase them. Attackers use these LummaC2 logs for credential stuffing and session hijacking by importing stolen browser cookies to bypass MFA and targeting managed service providers (MSPs) whose remote management tools enable mass deployment of ransomware. The subsequent ransomware operators leverage the stolen data for double extortion: If victims refuse to pay for decryption, attackers threaten to leak the LummaC2-harvested data. Readers seeking deeper ransomware intelligence should see the Acronis TRU ransomware profile.
What happened during the 2025 LummaC2 takedown and 2026 resurgence?
An international operation in May 2025 targeted LummaC2's infrastructure. The DOJ directly seized five user-panel domains, and a separate, wider Microsoft-led civil action took down, suspended or blocked roughly 2,300 additional domains associated with the operation, as well as shutting down numerous Telegram channels and redirecting traffic to sinkholes for monitoring. The disruption temporarily reduced the volume of LummaC2 logs for sale.
By early 2026, the LummaC2 threat resurfaced. Researchers observed distribution through CastleLoader, a heavily obfuscated loader that executes payloads in memory, and RenEngine, which spread LummaC2 via infected pirated games. Operators quickly stood up new C2 servers and migrated to more resilient platforms, demonstrating the lucrative nature of the LummaC2 MaaS model. Despite this resurgence, current threat data through mid-2026 shows Vidar, not LummaC2, holding the top position on major infostealer trackers, illustrating how quickly rankings shift after a disruption.
How does LummaC2 map to MITRE ATT&CK?
Tactic
Technique ID
Technique name
LummaC2 implementation
Initial access
T1566.001
Phishing: spearphishing attachment
Malicious ZIP / RAR containing MSI / ISO loaders.
T1566.002
Phishing: spearphishing link
Redirects to fake CAPTCHA or “human verification” sites.
T1189
Drive-by compromise
Malvertising and SEO poisoning redirect victims to payloads.
Execution
T1204.001
User execution: malicious link
Social-engineering victims to run commands via the Run dialog.
T1059.001
Command and scripting: PowerShell
Uses base64-encoded PowerShell one-liners to retrieve payloads.
T1218.005
System binary proxy: Mshta
Leverages mshta.exe to execute encoded scripts and bypass browser security.
Persistence
T1547.001
Boot or logon: registry run keys
Optional registry run keys enable auto-start on reboot.
Defense evasion
T1140
Deobfuscate / decode files
Decrypts embedded C2 domains and configuration opcodes.
T1027
Obfuscated files or information
Employs heavy packing and LLVM-based obfuscation.
T1497.001
Virtualization / sandbox evasion
Checks computer names, usernames and system resource limits to evade sandboxes.
T1562.001
Impair defenses: disable tools
Disables AMSI scanning and checks for active security processes.
T1036.008
Masquerading: file type
Disguises malicious scripts as common media or document extensions.
Discovery
T1082
System information discovery
Harvests hardware specs, OS details and network info
T1012
Query registry
Queries registry for browser versions and installed applications.
Collection
T1555.003
Credentials from web browsers
Siphons passwords and cookies from Chromium and Gecko browsers.
T1113
Screen capture
Takes screenshots during the exfiltration phase.
T1539
Steal web session cookie
Harvests active session tokens to bypass MFA.
Command and control
T1071.001
Application layer protocol: web protocols
Uses HTTP/HTTPS POST with custom user agents for C2 communications.
Exfiltration
T1041
Exfiltration over C2 channel
Transmits stolen credential packages via the primary C2 link.
Why are MSPs at elevated risk from Lumma Stealer?
MSPs aggregate access to many clients, making them attractive to LummaC2 affiliates. Attackers specifically search for logs containing remote monitoring and management (RMM) and professional services automation (PSA) credentials. A single compromised technician's account can grant control of hundreds of client networks, enabling multitenant ransomware deployment.
Moreover, theft of backup administrator credentials allows criminals to delete or corrupt backups before encryption, and stolen SaaS tokens provide immediate access to cloud services such as Microsoft 365, Salesforce and AWS, bypassing IP-based and MFA-based restrictions. These characteristics expose MSPs to a "blast radius" far greater than that of a single business. MSP defenders should refer to the Acronis TRU third-party compromise profile for broader supply-chain guidance.
How does Acronis protect against Lumma Stealer?
Acronis mitigates LummaC2 across prevention, detection, response and recovery layers. The table below maps each stage of the LummaC2 attack lifecycle to the risk, the capability required to address it and the corresponding Acronis response.
Attack stage
Risk
Required capability
Acronis capability
Outcome
Delivery and initial access
ClickFix lures, malvertising and phishing vectors deliver the LummaC2 payload or trick the user into pasting a malicious command.
Web-layer blocking, email inspection and vulnerability remediation.
Blocks access to fake CAPTCHA sites and malicious redirects, unpacks and neutralizes phishing payloads, and closes browser and Office vulnerabilities, reducing the likelihood of user-initiated execution.
Execution and evasion
Stealthy in-memory execution, process hollowing and AMSI-bypass techniques avoid dropping files on disk.
Behavioral detection of fileless and in-memory execution.
Visualizes the full attack chain to identify every touched account, isolates infected hosts and coordinates account suspension and token revocation to limit the blast radius.
Cleanup and monetization
Attackers attempt to delete or corrupt backups using stolen admin credentials, and reinfection risk persists if a compromised backup is restored.
Tamper-resistant backup and malware-free restoration.
Prevents backups from being deleted or corrupted even with stolen admin credentials, and scans backup images for loaders such as CastleLoader before restoration. Immutable backup does not neutralize credentials or data already exfiltrated before the incident was detected.
Frequently asked questions about Lumma Stealer (LummaC2)
How can I recognize a LummaC2 infection?
LummaC2 infections often originate from a user executing an attacker-provided PowerShell command via a fake CAPTCHA page. Security teams should monitor for unusual use of the Run dialog, especially when it spawns PowerShell or mshta.exe with base64-encoded arguments. In memory, the LummaC2 payload injects into legitimate processes such as explorer.exe and rapidly connects to a list of hard-coded domains behind Cloudflare. LummaC2 may also query registry keys and harvest browser versions. Detecting these behavioral markers and blocking the attack early is crucial because LummaC2 is designed to exfiltrate data quickly and self-delete.
What forensic evidence should I collect after a Lumma Stealer attack?
Investigators should capture memory dumps of processes associated with the LummaC2 infection, particularly injected hosts like explorer.exe. Examine the clipboard history to identify the PowerShell command that executed the payload and check the Run registry keys for persistence entries. Network logs should be reviewed for outbound HTTP / HTTPS POST requests to previously unknown domains or suspicious addresses. Collect stolen session tokens and cookies from browsers to understand what accounts may have been compromised by LummaC2, and preserve any local files identified by opcode 0 to determine data exfiltration scope.
Should all credentials be reset after a Lumma Stealer incident?
Yes. LummaC2 harvests passwords, cookies and session tokens from browsers and may capture VPN, RMM or backup-admin credentials. After confirming a LummaC2 infection, organizations should rotate all credentials, invalidate active sessions (especially SaaS tokens) and require reauthentication using phishing-resistant MFA. Acronis recommends FIDO2 hardware keys as the most reliable way to neutralize cookie hijacking. Also disable browser password-saving features and force users to adopt enterprise password managers to reduce exposure.
Does LummaC2 bypass multifactor authentication (MFA)?
Indirectly, yes. LummaC2 does not crack MFA mechanisms, but it steals session cookies that represent authenticated sessions. Attackers can import these LummaC2-stolen tokens into their own browser and access SaaS platforms or internal portals without requiring the password or MFA code. In corporate environments, this allows them to reach cloud services such as Microsoft 365, Salesforce and AWS. To counter this, organizations should deploy MFA that binds authentication to a hardware key and implement strict session-expiration policies.
Is Lumma Stealer still active after the 2025 takedown?
Yes, though its market position has changed significantly. The May 2025 operation seized five user-panel domains directly, and a separate, wider, Microsoft-led action took down, suspended or blocked roughly 2,300 additional domains and shut down numerous Telegram channels, causing a temporary drop in LummaC2 log listings. By early 2026, researchers reported a LummaC2 resurgence through new loaders like CastleLoader and, reportedly, RenEngine. However, current data through mid-2026 shows Vidar, not LummaC2, leading major infostealer trackers: ANY.RUN recorded a 65% drop in Lumma detections in Q4 2025, and independent research placed Vidar as the top infostealer on the Russian Market marketplace since November 2025. LummaC2 remains active and capable, but no longer clearly dominant, and infostealer rankings continue to shift quickly.
Does Lumma Stealer steal cryptocurrency or digital wallets?
Yes. LummaC2's asset matrix includes browser-based wallets such as MetaMask, Phantom, Exodus and Binance. LummaC2 extracts local wallet files and seed phrases, enabling direct theft of cryptocurrency. Users storing private keys in browser extensions or local folders are particularly vulnerable. To mitigate this, organizations should enforce hardware wallets or custodial services for corporate crypto holdings and avoid installing wallet extensions on business machines. Regularly review endpoint policies to block unauthorized browser extensions and educate users about the risk of mods, cracks or fake upgrades distributed through Lumma campaigns.
How does Lumma Stealer affect cloud accounts and backups?
LummaC2's theft of SaaS tokens gives attackers immediate access to Microsoft 365, Salesforce, AWS and other critical platforms. Attackers can modify files, download sensitive data or create persistence mechanisms without triggering MFA challenges. If the infected user has backup-administrator privileges, LummaC2 harvests credentials that allow ransomware operators to delete or corrupt backups, undermining recovery. This makes immutable backup and strict separation of backup-admin accounts essential. After a LummaC2 incident, organizations should verify the integrity of backup repositories and ensure that restored systems are scanned for loaders like CastleLoader.
What should MSPs do to remediate after a Lumma Stealer compromise?
MSPs must act quickly because one compromised admin credential can allow threat actors to push ransomware to all managed clients. Immediate steps include isolating the infected RMM or PSA systems, revoking all technician credentials, rotating client access keys and performing targeted threat hunting across managed endpoints. MSPs should also audit backup systems for deletion or tampering and validate that immutable storage policies are enforced. Educating technicians about ClickFix lures and enforcing hardware-based MFA reduces the chance of future LummaC2 infections.
