LummaC2: the malware that steals your passwords, cookies and crypto without leaving a trace
In May 2025, the FBI and CISA published a joint advisory about LummaC2, an information-stealing malware active since 2022 that had already compromised over 394,000 Windows computers worldwide in just two months. The warning remains relevant in 2026: after an international operation seized more than 2,300 domains from its infrastructure, LummaC2 rebuilt its servers and resumed operations at full force by July 2025. It remains an active threat today.
🔍 Suspicious message?
Analyze senders, links or files in real time with our scanner.
What is LummaC2 and why is it so dangerous
LummaC2, also known as Lumma Stealer, is an infostealer — malware designed to harvest information — sold as a service on Russian-language forums since 2022. Any cybercriminal can subscribe for around $250 per month and gain access to a ready-to-use tool with technical support, continuous updates and an administration panel. The model is called Malware-as-a-Service (MaaS), the same scheme used by ransomware groups.
What makes LummaC2 particularly dangerous is not only what it steals, but how it does it: it runs entirely in memory without writing any files to disk, allowing it to evade most antivirus software and endpoint detection tools. When it finishes, it disappears without leaving a trace.
What it actually steals
Once installed on a victim's machine, LummaC2 silently exfiltrates:
- Browser-saved credentials: usernames and passwords for all your services.
- Active session cookies: with a valid session cookie, an attacker can access your account without needing your password or second authentication factor. This is the method used to hijack YouTube channels, Gmail accounts and online banking sessions.
- Two-factor authentication (2FA) browser extensions: applications like Google Authenticator stored in the browser.
- Cryptocurrency wallets: seed phrases, private keys and balances.
- System information: username, computer name, installed software.
All of this is sent encrypted to the attacker's command-and-control (C2) servers within seconds.
How it reaches the victim's computer
LummaC2 uses several entry vectors, all relying on tricking the user into executing something:
Phishing emails with malicious attachments or links. The most common vector: an apparently legitimate email containing an Office document, a PDF, or a link that downloads the payload.
Fake CAPTCHAs (ClickFix technique). The user visits a compromised or fake website and is shown a CAPTCHA asking them to "verify they are human" by copying and pasting a command into the Windows Run dialog (Win+R). That command activates a hidden PowerShell script that downloads and installs LummaC2. This technique is particularly effective because the user believes they are performing a legitimate action.
Trojanized software installers. Pirated versions of popular programs (Adobe, Office, video games) with LummaC2 hidden inside the installer.
Fake GitHub repositories. Apparently legitimate code that, when executed, deploys the stealer.
Malicious advertising (malvertising). Search engine ads pointing to fake download websites.
The takedown operation and the comeback
In May 2025, Microsoft led an international operation alongside Europol, the FBI, ESET, Cloudflare and other industry partners. They obtained a court order in the United States and proceeded to seize and redirect more than 2,300 malicious domains that formed the backbone of LummaC2. The Department of Justicia estimated the malware had caused at least 1.7 million documented infections, while the FBI puts that figure closer to 10 million.
The blow was significant. LummaC2 activity dropped sharply in May and June 2025. But by July the operators had already rebuilt their infrastructure and resumed distribution campaigns. In 2026, the FBI and CISA confirm the malware remains active and is being used against critical infrastructure.
How to protect yourself
LummaC2 is designed to bypass traditional defences, but there are concrete steps that dramatically reduce the risk:
- Never run commands a website asks you to paste. No legitimate CAPTCHA will ever ask you to open the Windows Run dialog or paste commands into it. If you see this, close the window immediately.
- Download software only from official sources. Pirated software is the most common entry point for this type of malware.
- Use a password manager independent of your browser. Credentials saved directly in Chrome, Firefox or Edge are the primary target of infostealers. It reduces that attack surface significantly.
- Enable phishing-resistant MFA. Physical security keys (FIDO2) or standalone authenticator apps are far harder to steal than browser-based 2FA extensions.
- Keep your system and software updated. LummaC2 exploits known vulnerabilities to escalate privileges once installed.
- Be suspicious of emails with urgency or unexpected attachments. If you receive a suspicious email with an attachment or a link, analyse it first in the ORTSLAB scanner before opening anything.
Conclusion
LummaC2 is a clear example of the professionalisation of cybercrime: a product sold as a service, with constant updates, sophisticated evasion techniques and a global distribution network. It does not require the attacker to be an expert — anyone with money can rent it. That is why campaigns are so numerous and the impact so widespread.
The primary line of defence remains user judgement: do not execute what you did not request, do not download software from dubious sources, and verify any suspicious message before interacting with it.
Sources: FBI-CISA Joint Advisory AA25-141B (May 2025) · Microsoft Digital Crimes Unit · Europol · Red Canary Threat Detection Report 2026