For most of 2024 and early 2025, Lumma Stealer was the most popular information-stealing malware on criminal forums. Then, in May 2025, Microsoft, the US Department of Justice, Europol and Japanese police hit it with one of the largest takedowns ever aimed at an infostealer. Thousands of domains were seized and its control panels were disrupted.
Many expected that to be the end. It was not. Lumma was running again within weeks, survived a damaging doxxing campaign later that year, and was surging again by early 2026. This is the story of what happened, and why it matters for every organisation whose employees' passwords might end up in a stealer log.
What Is Lumma Stealer?
Lumma, also known as LummaC2, is information-stealing malware sold as a service on underground forums since at least 2022. Its main developer, known as "Shamel", is reported to be based in Russia and said in a 2023 interview that he had about 400 active clients.
Buyers subscribe to a control panel and get malware builds to spread however they like. Microsoft described Lumma's pricing tiers as ranging from $250 to $1,000, with full source code offered for $20,000. That low entry price is what made it so widespread: hundreds of criminals, including the ransomware-linked group Octo Tempest (also known as Scattered Spider), used it.
Once it runs on a computer, Lumma collects saved passwords, browser cookies and session tokens, credit card details, cryptocurrency wallets and system information, then sends everything to the attacker as a "log".
The May 2025 Takedown
On 13 May 2025, Microsoft's Digital Crimes Unit filed legal action in the US District Court for the Northern District of Georgia. The operation, announced on 21 May, involved:
- The takedown, suspension or blocking of around 2,300 malicious domains that formed Lumma's infrastructure.
- More than 1,300 seized domains redirected to Microsoft sinkholes, giving defenders visibility into infected machines.
- The US Department of Justice seizing Lumma's central command structure and disrupting the marketplaces where it was sold.
- Europol's European Cybercrime Centre and Japan's JC3 helping suspend infrastructure in their regions.
- Private partners including ESET, Bitsight, Lumen, Cloudflare, CleanDNS and GMO Registry.
Microsoft said it had found more than 394,000 infected Windows computers worldwide between 16 March and 16 May 2025 alone.
The Comeback
Just three days after the announcement, on 24 May 2025, Lumma's developer posted on an underground forum. He claimed authorities had exploited a server management flaw to wipe disks, but said the main server had been restored and the weakness closed.
Trend Micro's telemetry backed this up. Lumma's infrastructure ramped back up within weeks, and the number of targeted accounts returned to normal levels by June and July 2025. The operators changed how they worked:
- New hosting. Before the takedown, Lumma relied heavily on Cloudflare to hide its servers. Afterwards it moved to other providers, including Russia-based Selectel, which researchers describe as less responsive to abuse reports.
- Quieter channels. Operators moved away from public forums toward more private communication.
- Same lures, more of them. Fake software cracks and key generators, ClickFix fake CAPTCHA pages, GitHub repositories promoting game cheats, YouTube videos and Facebook ads all pointed to Lumma downloads.
The Doxxing and the Shift to Rivals
The second blow came from inside the criminal world. From late August to early October 2025, a campaign on a site calling itself "Lumma Rats" published what it claimed were personal details of five alleged Lumma operators, including names, financial records, passport numbers and email addresses. Trend Micro noted the information was not independently verified and may have been driven by rivals.
On 17 September 2025, Lumma's official Telegram accounts were reportedly compromised as well. Trend Micro saw Lumma's new samples and control servers decline steadily from early September, and customers began moving to competing stealers, mainly Vidar and StealC, citing instability and loss of support.
When one stealer stumbles, its customers simply switch to another. The number of stolen credentials reaching the dark web barely changes. What changes is the malware name in the log.
Lumma in 2026
Lumma did not disappear. Bitdefender reported that Lumma infections scaled up significantly between December 2025 and January 2026, much of it delivered through CastleLoader, a heavily obfuscated loader that runs its payload in memory. Recorded Future had already linked CastleLoader infrastructure to a Lumma command server in November 2025.
In March 2026, Microsoft Threat Intelligence reported a new ClickFix campaign that told victims to open Windows Terminal and paste a command. The final payload was Lumma Stealer, injected into Chrome and Edge to steal stored credentials. By 2026, threat intelligence firms were again describing Lumma as one of the fastest-growing infostealers, with subscriptions starting at around $250 a month.
So, is Lumma back? Yes. It never fully left, and when it weakened, other stealers filled the gap.
What Lumma Teaches About Takedowns
- Infrastructure can be rebuilt quickly. Seizing domains disrupts operations, but the people and code remain. Without arrests, a malware service can be back in weeks.
- The market adapts. Customers buy subscriptions, not loyalty. When one product falters they switch to Vidar, StealC or a newer brand.
- Old logs keep circulating. Credentials stolen before a takedown stay on the market long afterwards. Logs from years ago are still traded and resold today.
- Defence cannot rely on takedowns. Organisations need to assume some employee credentials are already stolen and monitor for them.
What Lumma Steals and Where It Goes
The logs are sold on dark web markets and Telegram channels, often within days of infection. Buyers include fraudsters, initial access brokers and ransomware affiliates. Verizon's 2025 Data Breach Investigations Report found that more than half of ransomware victims had domain credentials in stealer log markets before they were attacked.
How to Protect Your Organisation
- Monitor stealer logs for your domains. Whatever the malware is called this month, its logs end up in the same markets. DarkThreat watches stealer logs, forums and Telegram channels for your company's credentials. See DarkThreat plans.
- Reset and revoke immediately. When an employee's data appears in a log, change the password and revoke all active sessions, not just one.
- Clean the infected device. Resetting a password on a still-infected computer just leaks the new password.
- Stop saving work passwords in browsers. Use a managed password manager instead.
- Block common lures. Restrict cracked software, unknown GitHub downloads and the Run dialog for regular users, and train staff to recognise ClickFix pages.
- Use phishing-resistant MFA and session protection so stolen cookies are harder to reuse.
Key Takeaways
- Lumma was the leading infostealer before a Microsoft-led takedown in May 2025 seized about 2,300 domains.
- It was back within weeks on new hosting and quieter channels.
- A doxxing campaign in late 2025 pushed many customers to Vidar and StealC.
- Lumma surged again from December 2025, spread through CastleLoader and ClickFix.
- Takedowns slow stealers down but do not stop stolen credentials reaching the dark web, so continuous monitoring is essential.
Frequently Asked Questions
Was Lumma Stealer shut down?
Its infrastructure was heavily disrupted in May 2025, but no arrests of its core developers were announced and the service resumed within weeks. It was active again at scale by early 2026.
What replaced Lumma when it weakened?
Trend Micro observed former Lumma customers moving mainly to Vidar and StealC in late 2025. Other malware authors also marketed alternatives to them.
How do I know if my company's data is in a Lumma log?
Logs are sold privately, so you usually cannot see them through normal search. Dark web monitoring services collect and index stealer logs and alert you when your domains or employee emails appear.
How does Lumma usually get onto a computer?
Most often through fake software cracks, fake game cheats on GitHub, malicious ads, YouTube links and ClickFix fake CAPTCHA pages that trick users into running a command.
Does MFA protect against Lumma?
Partly. MFA stops attackers who only have a password, but Lumma also steals session cookies that can bypass MFA. Revoking sessions and using phishing-resistant MFA with token protection reduce that risk.
Related Resources
- ClickFix Fake CAPTCHA Attacks and the Infostealer Pipeline
- Infostealer Logs: What They Contain and Why You Need to Monitor Them
- Why Stealer Malware Fuels Dark Web Markets
- How Infostealer Malware Enables Ransomware: The Attack Kill Chain
- How to Monitor the Dark Web for Stolen Employee Credentials
Sources
- Microsoft: Disrupting Lumma Stealer, Microsoft leads global action against favored cybercrime tool
- Trend Micro: Lumma Stealer returns
- Trend Micro: The impact of the Lumma Stealer doxxing
- LummaStealer infections surge after CastleLoader campaigns (Bitdefender research)
- The Register: Microsoft spots ClickFix campaign abusing Windows Terminal
- SOCRadar: Top 10 stealer logs
