Lumma Stealer
LummaC2 StealerLummaStealer
Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA)… Source: MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 21 Oct 2026 · last seen on 21 Oct 2026
News
- Decades-Old Windows Utility Powers Modern ClickFix AttackDark Reading · 21 Oct 2026
MITRE ATT&CK techniques
Initial Access
T1195Supply Chain Compromise 19 Sigma rulesT1566.001Spearphishing Attachment 21 Sigma rulesT1566.002Spearphishing Link 3 Sigma rules
Execution
T1059.001PowerShell 40 Sigma rulesT1059.006Python 10 Sigma rulesT1059.010AutoHotKey & AutoITT1204User Execution 49 Sigma rulesT1204.002Malicious File 32 Sigma rulesT1574.001DLL 40 Sigma rules
Persistence
T1176.001Browser Extensions 2 Sigma rulesT1547.001Registry Run Keys / Startup Folder 38 Sigma rules
Privilege Escalation
Credential Access
Discovery
T1082System Information Discovery 18 Sigma rulesT1217Browser Information DiscoveryT1497.001System Checks 3 Sigma rulesT1518.001Security Software Discovery 5 Sigma rulesT1622Debugger Evasion 1 Sigma rules
Collection
T1074.001Local Data Staging 4 Sigma rulesT1113Screen Capture 6 Sigma rulesT1119Automated Collection 5 Sigma rules
Command and Control
Exfiltration
Stealth
T1027Obfuscated Files or Information 61 Sigma rulesT1027.013Encrypted/Encoded FileT1036.008Masquerade File TypeT1140Deobfuscate/Decode Files or Information 17 Sigma rulesT1218.005Mshta 8 Sigma rulesT1218.015Electron ApplicationsT1564.003Hidden Window 7 Sigma rulesT1620Reflective Code Loading 3 Sigma rules
Defense impairment
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗ malpedia.caad.fkie.fraunhofer.de ↗