Lumma Stealer should be dead. Microsoft’s Digital Crimes Unit, the FBI, and Europol seized roughly 2,300 domains tied to the malware in May 2025, cutting off the command-and-control infrastructure behind one of the most widely distributed password-stealing tools in cybercrime. Officials called it a global takedown. It wasn’t the first time law enforcement had gone after the infostealer market, and it would not be the last.
Fourteen months later, Lumma is still running. Bitdefender confirmed in February 2026 that the malware had rebuilt its command infrastructure and was spreading again, concentrated in India with secondary activity across the US and Europe. Microsoft’s own threat intelligence team disclosed a new delivery method in March 2026, built around a Windows Terminal-based infection chain. The tool that was supposedly dismantled a year earlier had not just survived. It had kept shipping updates.
That pattern, survive, rebuild, ship, has become the defining feature of the infostealer economy. It’s forcing a hard question inside security teams: what does a takedown actually accomplish when the malware-as-a-service business model treats law enforcement action as a cost of doing business, not an extinction event?
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is Lumma Stealer, and Why Security Teams Watch It
Lumma Stealer, also tracked as LummaC2, is commodity malware sold as a subscription rather than a one-time tool. Sophos has documented its Telegram-based sales model running since 2022, complete with update cycles and customer support for buyers. Bitdefender’s research puts 2023 pricing tiers between $250 and $20,000 for the full package. The FBI’s own spring 2024 accounting found premium access listed as high as $2,500, spread across more than 21,000 posts on cybercrime forums.
Once installed, Lumma Stealer goes after browser-stored passwords, cookies, and two-factor authentication tokens, plus cryptocurrency wallets including MetaMask, Binance, and Electrum. It also pulls system metadata, hardware identifiers, and account data tied to Discord and Steam. None of that requires a software exploit. Lumma spreads mainly through social engineering: fake software cracks, bogus game or movie downloads, and so-called ClickFix prompts that trick a user into pasting a malicious command into the Windows Run dialog or Terminal themselves.
That distribution model is part of why the malware has proven so hard to kill. There’s no single vulnerability to patch. There’s a supply chain of affiliates, each running independent lure campaigns, all buying access to the same back-end infrastructure.
Timeline: How Lumma Outlasted Its Own Enforcement Actions
Lumma isn’t the only infostealer law enforcement has targeted since 2023. It’s the one that keeps coming back.
| Operation | Date | Coordinated By | Malware Targeted | Verified Outcome |
|---|---|---|---|---|
| Operation Magnus | Oct 28, 2023 | Dutch National Police, US DOJ, FBI, Europol, plus Australia, Belgium, Portugal, UK | RedLine, META | 3 servers and 2 domains seized, developer indicted, 2 arrests in Belgium |
| Operation Secure | 2024 | INTERPOL, 26 countries, led by Vietnamese police, with Group-IB, Trend Micro, Kaspersky | Lumma, RisePro, META, plus 66 other variants | 41 servers seized, 32 arrests, 216,000 victims notified, 100GB of stolen data recovered |
| LummaC2 Takedown | May 21, 2025 | US DOJ, Microsoft Digital Crimes Unit, FBI, Europol | Lumma Stealer specifically | ~2,300 domains seized, ~394,000 infected devices identified |
| Operation Endgame (Nov 2025 action) | Nov 10-13, 2025 | Eurojust, 10 countries | Rhadamanthys, VenomRAT, Elysium botnet | Malware-as-a-service infrastructure disrupted; Lumma not among the targets |
Operation Magnus, in October 2023, targeted RedLine and META, two of Lumma’s direct rivals in the infostealer market. Dutch police worked with the FBI, Europol, and agencies in Australia, Belgium, Portugal, and the UK to seize three servers and two domains, arrest two suspects in Belgium, and indict an alleged RedLine developer named Maxim Rudometov. RedLine has not returned in any meaningful way since.
Lumma wasn’t part of that first wave. It joined the target list months later, when INTERPOL coordinated Operation Secure across 26 countries, an effort led by Vietnamese police with support from Group-IB, Trend Micro, and Kaspersky. That operation covered 69 infostealer variants, including Lumma, RisePro, and META, and disrupted more than 20,000 malicious IPs and domains. It wasn’t enough to stop Lumma specifically, which is why a second, dedicated action followed about a year later.
Inside the May 2025 Takedown
On May 21, 2025, the US Department of Justice, Microsoft’s Digital Crimes Unit, the FBI, and Europol moved directly against Lumma’s infrastructure. Microsoft’s civil action led to the seizure of roughly 2,300 domains that had served as command-and-control points, plus five domains Microsoft cut off directly through its own hosting relationships. Microsoft’s count put infected Windows devices at approximately 394,000 globally. The FBI’s Dallas Field Office, cited separately by Reuters, put the number of compromised computers closer to 400,000.
Microsoft’s threat intelligence team tracks the alleged operator or operators behind the malware under the label Storm-2477. The DOJ’s parallel action seized domains tied to the LummaC2 sales operation directly. For a few days, it looked like the takedown might have worked. Then it didn’t.
How Lumma Rebuilt Its Infrastructure in Weeks
Security firm Lumu, which tracks indicators of compromise in near real time, recorded a spike to 287 Lumma-linked IoCs on May 22, one day after the takedown. By May 28 and 29, that figure climbed to 457 and 440 respectively, well above pre-takedown levels. Operators reportedly told researchers their central server had been remotely wiped rather than physically seized, which may explain how quickly replacement infrastructure came online.
Trend Micro’s research team confirmed the pattern in a report titled “Back to Business: Lumma Stealer Returns with Stealthier Methods,” tracking a full return to pre-takedown targeting volumes by July 2025. The infrastructure itself moved too. BleepingComputer reported that operators shifted hosting from Cloudflare to the Russian provider Selectel, a common tactic for putting distance between a malware operation’s back end and Western law enforcement and hosting-abuse teams.
The New Delivery Playbook: GitHub, ClickFix, and CastleLoader
Rebuilding servers is one problem. Getting the malware back onto victims’ machines is another, and that’s where Lumma’s operators made the more interesting adjustments. BleepingComputer identified four active distribution channels in the rebuilt campaign: fake software cracks and keygens, GitHub repositories disguised as legitimate tools, YouTube and Facebook posts linking to malicious downloads, and ClickFix pages, fake CAPTCHA or verification prompts that walk a victim through copying and running a malicious command themselves.
Bitdefender’s labs team documented a related loader, CastleLoader, driving a fresh wave of infections between December 2025 and January 2026. CastleLoader carries a distinct network signature: it triggers deliberately failed DNS lookups against nonexistent domains following a random-string pattern, which Bitdefender says exposed hundreds of samples tied to the same campaign once researchers started watching for it. The payload runs through two-stage XOR decryption and LZNT1 decompression before unpacking into memory, which helps it avoid leaving a static file on disk for antivirus tools to scan.
The chain below simplifies the publicly reported infection path across these sources. It’s an illustration of the reported stages, not a literal detection rule.
Fake crack site / GitHub repo / YouTube "tutorial" link
|
v
ClickFix-style fake CAPTCHA or "verify you're human" prompt
|
v
Victim pastes and runs a clipboard command via Windows Run or Terminal
|
v
CastleLoader stage: two-stage XOR decryption + LZNT1 decompression in memory
|
v
Lumma Stealer payload executes, harvests browser, wallet, and 2FA data
|
v
Stolen data exfiltrated to attacker-controlled C2 (e.g. Selectel-hosted)February and March 2026: Confirmation It Never Really Left
By February 11, 2026, Bitdefender was ready to call it: Lumma had rebuilt its command-and-control infrastructure and was spreading worldwide again, with the heaviest concentration of infections in India and secondary clusters in the US and Europe. Ars Technica covered the same resurgence under a headline that captured the mood among defenders, describing a malware family that was back with lures hard to resist.
Microsoft’s threat intelligence team added to the picture on March 5, 2026, disclosing a new delivery variant built around Windows Terminal rather than the more commonly monitored Run dialog. Separately, SentinelOne’s telemetry for early 2026 placed Lumma among the most frequently detected malware families in its dataset, alongside long-running commodity threats Agent Tesla and Formbook, out of more than 155,000 infostealer detections logged in the same window. None of that reads like a malware family in decline.
Why Infostealer Takedowns Keep Falling Short
As BankInfoSecurity put it, the resurgence directly challenges the premise of the global takedown. Every operation described above produced real, measurable results: servers seized, domains taken offline, suspects arrested, victims notified. None of that is in question. The problem is structural. Lumma isn’t a single piece of software with one point of failure. It’s sold as a service to an unknown number of affiliates who run their own campaigns and don’t need to know who operates the back end. Taking down infrastructure removes the current set of servers. It doesn’t remove the customer base, the source code, or the affiliates’ existing distribution channels, which is why Lumu could watch replacement infrastructure light up within a single day of the May 2025 action.
There’s also a jurisdiction problem. Shifting hosting to a Russian provider like Selectel puts the back end largely outside the reach of the US and European agencies that led the takedown, mirroring a pattern seen across ransomware-as-a-service operators for years. Arresting the developer behind a tool, as happened with RedLine’s Maxim Rudometov, is far more disruptive than seizing servers. Lumma’s alleged operators, tracked by Microsoft under the Storm-2477 label, remain unidentified publicly.
Inside the Infostealer-as-a-Service Economy
Lumma’s pricing history gives a rough sense of the economics driving this resilience. Bitdefender’s data on 2023 tiers, $250 to $20,000 for the full package, combined with the FBI’s spring 2024 count of more than 21,000 forum listings advertising access, point to a market with enough paying customers to make rebuilding worthwhile within weeks rather than months. A malware-as-a-service operator doesn’t need to personally run phishing campaigns or manage droppers. Affiliates handle distribution. The platform just needs to stay online and keep collecting stolen data to sell or exploit.
That business model is also why competitive displacement matters more here than it would for traditional malware. When Operation Magnus dismantled RedLine and META in 2023, their affiliates didn’t retire. Historically, displaced cybercrime affiliates migrate to whichever platform is still standing, and Lumma was one of the infostealers left standing. The same dynamic likely applies after the November 2025 Operation Endgame action against Rhadamanthys, VenomRAT, and the Elysium botnet.
Competitive Landscape: How Lumma Stacks Up Against Rival Infostealers
Lumma’s durability looks more unusual next to its peers. Some of the biggest names in the infostealer market from just three years ago are gone. Others never faced a coordinated public takedown at all.
| Malware Family | Status as of Early 2026 | Notable Enforcement Action | Primary Distribution |
|---|---|---|---|
| Lumma Stealer (LummaC2) | Active, rebuilt after two direct actions | Operation Secure (2024), DOJ/Microsoft takedown (May 2025) | Fake cracks, ClickFix, GitHub, YouTube |
| RedLine | Dismantled | Operation Magnus (Oct 2023) | Formerly phishing, cracked software |
| META Stealer | Dismantled | Operation Magnus (2023), Operation Secure (2024) | Formerly malvertising |
| Rhadamanthys | Disrupted | Operation Endgame (Nov 2025) | Malvertising, phishing |
| Agent Tesla | Active | No major public takedown reported | Phishing email attachments |
| Formbook | Active | No major public takedown reported | Phishing email attachments |
The pattern is hard to miss. Infostealers that faced a single, well-coordinated action against their core developer or infrastructure, like RedLine, tend to stay down. Infostealers built around a distributed affiliate model, like Lumma, have kept operating through multiple actions because no single arrest or server seizure removes the whole business.
What This Means for Businesses and Security Teams
For security teams, the practical lesson isn’t that takedowns are worthless. It’s that they buy time, not closure. Every major action against Lumma bought weeks to months of reduced activity, useful for patching, user retraining, and credential rotation, but never a permanent removal of the threat. Organizations that treated the May 2025 takedown as a reason to deprioritize infostealer defenses were, in effect, planning around a headline instead of a threat model.
The exposure is straightforward even without a Lumma-specific breach-cost figure. Stolen browser sessions and authentication cookies routinely let attackers skip password-based multi-factor authentication entirely, since a hijacked session token doesn’t need a password to use. Corporate credentials harvested by consumer-facing infostealers, often from an employee’s personal device rather than a corporate laptop, have become one of the more common initial-access vectors resold on the same forums where Lumma advertises subscriptions.
5 Predictions for the Infostealer Economy Through 2027
- More consolidation around survivors. With RedLine and META gone and Rhadamanthys disrupted, expect displaced affiliates to keep concentrating around Lumma and other still-standing platforms like Vidar and StealC, growing their market share by default rather than innovation.
- Hosting keeps migrating east. The Cloudflare-to-Selectel move is likely a preview. More infostealer operators will shift infrastructure toward hosting providers outside easy reach of US and EU legal process.
- Session-token theft overtakes password theft as the headline risk. As passkeys and phishing-resistant MFA spread, stolen session cookies, which sidestep authentication entirely, become the more valuable product infostealers are built to harvest.
- Another coordinated action against Lumma specifically is likely within 12 to 18 months. Given the pattern of Operation Secure in 2024 and the dedicated takedown in 2025, agencies have shown a willingness to repeat the exercise rather than write the malware off.
- Developer-level prosecutions, not just server seizures, become the priority. The RedLine case suggests identifying and indicting the people behind a tool, as opposed to just its infrastructure, is the more durable path to actually ending an operation.
How Security Teams Are Responding
Practical defense against infostealers leans less on any single patch and more on visibility and response speed. Centralized logging and detection platforms give security teams a way to spot the kind of anomalous authentication activity, a session token suddenly used from a new device or country, that follows a successful infostealer infection. Teams building or hardening that kind of detection stack can find step-by-step setup guides for two open-source options in Wazuh SIEM Setup With Docker and Graylog SIEM Setup.
Beyond tooling, the recurring advice from the researchers tracking Lumma is procedural: rotate credentials and session tokens after any suspected infection rather than just removing the malware, restrict execution of commands pasted from the clipboard into Run or Terminal prompts, and treat “verify you’re human” pages that ask for a manual command as an automatic red flag rather than a normal CAPTCHA.
Frequently Asked Questions
What is Lumma Stealer?
Lumma Stealer, also known as LummaC2, is a subscription-based infostealer malware sold since 2022 on Telegram and cybercrime forums. It harvests browser passwords, cookies, two-factor authentication tokens, and cryptocurrency wallet data from infected Windows devices.
Is Lumma Stealer still active in 2026?
Yes. Bitdefender confirmed rebuilt command-and-control infrastructure and active worldwide spread in a February 11, 2026 report, and Microsoft disclosed a new Windows Terminal-based delivery variant on March 5, 2026.
Did law enforcement really take down Lumma Stealer?
Twice, directly. Operation Secure in 2024 disrupted it alongside 68 other infostealer variants, and a dedicated US DOJ, Microsoft, FBI, and Europol action on May 21, 2025 seized roughly 2,300 domains. Both times, the operation reduced activity temporarily before infrastructure was rebuilt.
How does Lumma Stealer infect a computer?
Mainly through social engineering rather than software exploits: fake software cracks and keygens, malicious GitHub repositories, YouTube or Facebook links, and ClickFix-style fake CAPTCHA pages that trick users into pasting and running a malicious command themselves.
What data does Lumma Stealer target?
Browser-stored credentials and cookies, two-factor authentication tokens, cryptocurrency wallets such as MetaMask, Binance, and Electrum, system and hardware metadata, and account data linked to platforms including Discord and Steam.
How is Lumma Stealer different from ransomware?
Infostealers like Lumma copy and exfiltrate data quietly without encrypting anything or demanding a ransom. The stolen credentials are typically sold on cybercrime forums or used to enable a separate attack, including ransomware deployment using stolen access.
How much does Lumma Stealer cost on cybercrime forums?
Bitdefender’s research on 2023 pricing found tiers from $250 to $20,000 for the full package. The FBI’s spring 2024 accounting listed premium access as high as $2,500 across more than 21,000 forum posts advertising the tool.
What should businesses do to defend against infostealers?
Deploy centralized logging to catch anomalous authentication events, rotate credentials and session tokens after any suspected infection, restrict clipboard-to-terminal command execution where possible, and train staff to treat manual “verification” prompts as a red flag rather than routine friction.
Related Coverage
- Klue Breach Hits 200 Firms via 4-Year-Old Credential [2026]
- Match Group Breach: ShinyHunters Claim 10M Records [2026]
- North Korea Poisons 140 npm AI Packages in 19 Min [2026]
- Wazuh SIEM Setup With Docker: 14 Steps, 60 Min [2026]
- The Gentlemen Ransomware Tops Qilin: 94 Victims [2026]
For ongoing coverage of ransomware, data breaches, and zero-day threats, see the cybersecurity hub.
