← All threat actors
Lumma Stealermalware / toolS1213 ↗
Lumma Stealer is an information stealer malware family in use since at least 2022. Lumma Stealer is a Malware as a Service (MaaS) where captured data has been sold in criminal markets to Initial Access Brokers.
Reports / IOCs (VT)
289 reports · 41,189 IOCs
Reported activity
2024 – 2026
ATT&CK techniques in reports
- T1027 Obfuscated Files or Information8
- T1071.001 Web Protocols8
- T1539 Steal Web Session Cookie5
- T1140 Deobfuscate/Decode Files or Information5
- T1204 User Execution5
- T1204.002 Malicious File4
- T1095 Non-Application Layer Protocol4
- T1059.003 Windows Command Shell4
- T1204.004 Malicious Copy and Paste4
- T1041 Exfiltration Over C2 Channel4
- T1528 Steal Application Access Token3
- T1102 Web Service3
- T1132.001 Standard Encoding3
- T1571 Non-Standard Port3
- T1055.002 Portable Executable Injection3
- T1106 Native API3
- T1012 Query Registry3
- T1036 Masquerading3
- T1082 System Information Discovery3
- T1119 Automated Collection3
Also known as
LummaC2 Stealer