Executive Summary
Lumma Stealer (also known as LummaC2) is a sophisticated Malware-as-a-Service (MaaS) operation that exfiltrates credentials, cryptocurrency wallets, and browser cookies. The malware is primarily distributed via social engineering campaigns, including 'ClickFix' tactics that trick users into running malicious PowerShell commands. In a significant global effort, Cloudflare collaborated with Microsoft, the U.S. DOJ, Europol, and other partners to disrupt Lumma's command-and-control (C2) infrastructure and marketplace domains.
The attack chain involves deceptive popups on compromised sites that instruct users to execute keyboard shortcuts, launching remote PowerShell scripts to download the payload. Lumma's operators invest heavily in evasion techniques and abuse legitimate infrastructure, such as Cloudflare's proxy services, to mask their backend IP addresses.
This disruption aims to dismantle the Lumma ecosystem by denying operators access to their administrative panels and search-indexed 'logs' of stolen data. Organizations must remain vigilant as the MaaS model allows for rapid infrastructure shifts, requiring layered defense strategies focusing on credential hygiene and script execution restrictions.