Lumma Stealer Browser Fingerprinting

Tim Peck@timpeck

•updated Nov 13, 2025•7•0•141

Detects outbound HTTP GET requests consistent with Lumma Stealer's browser fingerprinting activity. This activity involves contacting a C2 endpoint at '/api/set_agent' with specific URL parameters ('id', 'token', 'description') to register the victim and gather system information.