Lumma Stealer
Often delivered by fake verify-you-are-human pages.
- Also called
- LummaC2
- Seen since
- 2022
- Runs on
- Windows
- Sold as
- Tiered subscriptions on forums and Telegram
What Lumma Stealer takes
- Passwords, cookies, and autofill from Chrome, Edge, Firefox, and other browsers
- Cryptocurrency wallets and wallet extensions
- Data from two-factor browser extensions
- Documents and other files that match what the buyer asked for
How it spreads
- Fake CAPTCHA pages that tell the visitor to paste a command into Windows
- Cracked software and fake installers
- Malicious ads and fake browser updates
Background
Lumma grew fast from 2023 and became one of the stealers that produced the most new logs.
In May 2025 Microsoft, the US Department of Justice, Europol, and Japanese authorities took down a large part of the infrastructure Lumma customers used. Takedowns cut off new collection. Files that were already stolen stay in circulation and stay searchable.
Checking for your logins
Search an email, username, company domain, login URL, password, or IP. The index covers logs from every family, Lumma Stealer included. A dump usually does not record which malware wrote it, so a result will not say it was Lumma Stealer.
The steps afterwards are the same either way. Clean the device, then change passwords from a machine that was not infected. What to do.
Other families
- RedLine Stealer. For years the most common Windows stealer in circulating logs.
- Vidar. A long-running Windows stealer, often dropped with other malware.
- Raccoon Stealer. A cheap Windows stealer. Its alleged operator was arrested in 2022.
- StealC. A 2023 Windows stealer that copies features from older families.
- Atomic macOS Stealer. A macOS stealer. It prompts for the user password and opens the Keychain.
Questions
- How does a Lumma infection usually start?
- A common path is a page that looks like a CAPTCHA. It tells the person to open Run or PowerShell and paste a command. That command fetches the stealer.
- Did the 2025 takedown remove Lumma logs from search?
- No. It disrupted new collection. Logs already posted on Telegram remain in the index.
Search an email, username, URL, password, or IP. Open search.
More
- About
What the index searches and who it is for.
- What is a stealer log
The dump one infected machine produces.
- Found in a log
Clean the device first, then change passwords.
- Company domain
Find staff and customer addresses in the index.
- Sources and the 10,000 limit
Telegram bots, and why Elasticsearch stops at 10,000.