Anatomy of a LummaC2 Attack: From Phishing to Log Resale in 2026

LummaC2 has become one of the most studied infostealers of the past three years, and 2026 marks an interesting inflection point in its trajectory. The May 2025 disruption led by Microsoft and the United States Department of Justice put real pressure on the operation, yet a year later the malware family is still distributing, still collecting, and still feeding the underground log economy. This analysis walks through a full LummaC2 intrusion as it typically unfolds in 2026, from the moment a user clicks a fake CAPTCHA to the moment their session cookies are listed for resale on a private marketplace. The objective is to give blue teams, CISOs, and analysts a clear, vendor-neutral mental model of the chain so they can map their detection and response coverage against it.

LummaC2 in Brief

LummaC2, also referenced as Lumma Stealer and tracked by MITRE under software ID S1213, is a malware-as-a-service infostealer that surfaced in late 2022 on Russian-language forums and Telegram. The codebase is primarily C, with helper components written in higher level languages depending on the build. The service follows the classic MaaS pricing model observed across the ecosystem. Entry tier subscriptions sit around 250 dollars per month and grant access to a build with standard features. Mid tiers, in the 500 to 1000 dollar per month range, unlock additional modules, longer panel access, and more frequent builder updates. The top tier, reportedly priced around 20 000 dollars, offers source code access and is reserved for a small number of operators who wish to fork or maintain a private variant.

The buyer community is organized around Telegram for support, build delivery, and panel announcements, while strategic discussion happens on closed forums. The operator pool ranges from low skill affiliates buying the entry tier and relying on prebuilt distribution kits, to seasoned crews running their own ClickFix landing pages, malvertising campaigns, and resale logistics. This wide skill spectrum is one of the reasons LummaC2 produces such a steady stream of logs across all enterprise sectors and geographies.

Phase 1: Distribution Vectors in 2026

The most striking shift in 2026 is the dominance of ClickFix as the initial access technique. ClickFix relies on a fake CAPTCHA, a fake Cloudflare verification, or a fake Windows update prompt that asks the user to press Windows plus R, paste a clipboard payload, and hit Enter. The clipboard already contains a PowerShell command pre populated by a malicious script on the page. From the user point of view, they are simply proving they are not a robot. From the host point of view, they are voluntarily executing a downloader. Microsoft Security has documented this pattern repeatedly in its public reporting and considers it the leading vector for several stealer families, LummaC2 included.

Google Ads malvertising remains a strong second vector. Operators bid on keywords related to popular software such as Notion, OBS, AnyDesk, or specific developer tools. The ad points to a lookalike domain that mirrors the legitimate vendor site and serves a trojanized installer. Trojanized GitHub releases are also frequent. The attacker either compromises a maintainer account or creates a fork with a confusing name and pushes a release containing a malicious binary alongside legitimate looking source. YouTube cracks complete the picture. A short tutorial video, often AI generated voiceover on top of stolen footage, links in the description to an archive password protected with the password shown in the video, which both bypasses sandbox unpacking and creates a sense of legitimacy.

These four vectors share a common property. None of them rely on a software vulnerability. They all rely on the user. This shifts the prevention burden from patching to behavior, which most enterprise security programs are still adapting to.

Phase 2: Infection

Once the initial payload runs, the chain enters the loading phase. The PowerShell or rundll32 stage typically retrieves a second stage from a compromised legitimate domain or a freshly registered low cost TLD. The loader uses common evasion patterns. Anti VM checks query CPUID, registry artifacts, and the presence of virtualization drivers, mapped to MITRE ATT&CK technique T1497.001. Anti debug checks include IsDebuggerPresent, NtQueryInformationProcess with the ProcessDebugPort class, and timing checks based on RDTSC differentials. None of these techniques are novel, but combined they raise the bar enough to defeat naive sandboxes.

Persistence is usually established through a Run key under HKCU, which corresponds to T1547.001. Some builds prefer scheduled tasks for stealth, especially when the operator wants to survive a reboot without raising the noise level of a Run key write. The persistence is sometimes installed only after the first successful exfiltration, which complicates static detection because the malicious binary may already be gone by the time persistence appears on disk.

Command and control communication is one of the most refined parts of the operation. T1071.001 covers the use of HTTPS as the application layer protocol, and T1573.002 covers the asymmetric encryption used inside the channel. LummaC2 builds rotate domains aggressively and frequently use CDN fronted endpoints or compromised legitimate websites as relays. The traffic itself looks like benign HTTPS to most network sensors, which is why endpoint telemetry remains essential.

Phase 3: Collection

Collection is where the malware delivers its actual value to the operator. LummaC2 walks through Chromium and Gecko based browser profiles, reading the Login Data SQLite database (T1555.003), the cookies database (T1539), and autofill stores. On modern Chromium versions the credential store is protected by the App Bound encryption layer introduced in 2024, but the malware decrypts the master key through the legitimate API while running under the user context, so the protection is effectively bypassed without exploiting any vulnerability. Cookies extraction is particularly damaging because session cookies grant attackers an authenticated foothold that bypasses MFA, including TOTP and push based methods. Only phishing resistant MFA such as FIDO2 stops cookie reuse from delivering the keys to the kingdom.

Beyond browsers, the stealer enumerates crypto wallet extensions and desktop wallets (T1217), copies Discord and Telegram session tokens (T1539), captures clipboard content if the operator enabled the option, and grabs files from the desktop, downloads, and document folders matching configurable patterns (T1119). Common patterns include wallet seed phrases stored in text files, VPN configuration files, and SSH private keys. System information is enumerated through standard APIs and command line tools (T1082) to populate the log header with hostname, OS version, locale, GPU, CPU, installed software, and timezone, all of which are used by buyers to filter logs by geography or value.

The collection phase is fast. Most variants complete the entire harvest in under a minute on a typical workstation. This is by design because the longer the malware runs, the higher the probability that EDR behavioral heuristics detect the chain.

Phase 4: Exfiltration

After collection, LummaC2 packages the harvest into a compressed archive, often a custom container or a ZIP, and encrypts the payload before transmission. The archive is then exfiltrated to the C2 server (T1041) or to an alternative channel such as a cloud storage endpoint (T1567). Typical log size in 2026 ranges from 500 kilobytes for a freshly installed system with limited browser history, up to 5 megabytes for a heavy professional workstation with multiple browser profiles, password managers, and active sessions. The transfer takes seconds. Once exfiltration completes, the malware can either self delete, drop persistence, or wait for an additional command depending on the build configuration.

This is the moment where the victim has effectively lost control of every credential cached on the device, every active web session, and any sensitive file in the configured collection paths. The next phases happen entirely on attacker infrastructure.

Phase 5: Distribution and Monetization

The monetization funnel for LummaC2 logs has stabilized into a three tier structure across the broader infostealer ecosystem. The first tier is free public distribution through Telegram, where logs appear in large channels run by traffers and resellers as a teaser for paid products. These free drops are usually older logs or logs that have been parsed, deduplicated, and filtered before public release. The second tier is cloud resale, where curated archives are sold per gigabyte through underground panels, with filters by country, antivirus presence, or specific corporate domains. The third tier is the VIP marketplace, where individual high value logs, often containing corporate credentials or fresh banking sessions, are sold one by one to vetted buyers.

The time between initial infection and the appearance of a log in a free Telegram channel is short. Based on what threat researchers across the ecosystem have observed, including teams at Sekoia, Recorded Future, KELA, and Flare, this delay typically ranges from thirty minutes to a few hours. For high value logs flagged by parsers, the path to a private VIP listing can be even faster. This compressed timeline is the single most important fact for defenders to internalize. By the time a victim notices anomalous behavior on their workstation, their credentials may already be circulating across multiple resale tiers. Naming operational channels publicly does not help defenders, so we deliberately avoid that here, but the existence of the funnel is well documented.

Generic IOCs and TTPs

The MITRE ATT&CK techniques referenced above provide a stable backbone for detection engineering against LummaC2 and most modern stealers. T1497.001 for virtualization and sandbox evasion. T1547.001 for Registry Run Keys persistence. T1071.001 and T1573.002 for application layer protocol with asymmetric cryptography. T1555.003 for credentials from web browsers. T1539 for steal web session cookie. T1217 for browser bookmark and wallet discovery. T1119 for automated collection. T1082 for system information discovery. T1041 for exfiltration over C2 channel and T1567 for exfiltration over web service.

Behavioral patterns are more durable than file hashes. We deliberately do not include invented hash values in this report because a hash that has not been observed in real telemetry has no defensive utility and creates noise in detection pipelines. The patterns to watch are PowerShell or rundll32 execution chains starting within seconds of a browser tab interaction, access to Login Data SQLite by a non browser process, copy of the Cookies database to an unexpected path, brief lived archive creation followed by a network connection to a freshly seen domain, and Run key writes by short lived processes. Each of these patterns, taken alone, may be benign. Their combination within a tight time window is highly indicative.

May 2025 Microsoft and DOJ Takedown

Operation Lumma, announced on May 21 2025 by Microsoft and the United States Department of Justice, was the largest coordinated action against a single infostealer operation to date. The action seized more than 2300 command and control domains and disrupted significant portions of the distribution and panel infrastructure. The partner list included the Microsoft Digital Crimes Unit, the DOJ, Europol, the Japanese Cybercrime Control Center, ESET, Bitsight, Cloudflare, Lumen, and others. The combined effect was an estimated drop of around 70 percent in observed LummaC2 volumes for the months following the operation, according to multiple public reports cross referenced across vendor blogs and Microsoft Security communications.

The strategic lesson is more nuanced than the headline. Within months, distribution resumed under partially rebranded infrastructure, with new C2 domain pools and adjusted builder versions. By the second half of 2025 and into 2026, LummaC2 had returned to a meaningful share of new logs reaching Telegram channels, although still below pre takedown peaks. This pattern is consistent with what we have seen historically across MaaS takedowns. A single coordinated action significantly damages an operation but rarely terminates it, because the underlying economics, the buyer demand, and the technical talent pool all persist. Disruption buys time and forces a rebuild, which itself slows down innovation, but it does not by itself eliminate the threat.

Enterprise Protection

Defending against LummaC2 in 2026 is a layered exercise. EDR with strong behavioral heuristics is the foundation, with rules tuned to detect the access patterns to credential stores and the short PowerShell or rundll32 chains following browser activity. Application allowlisting reduces the surface for ClickFix style execution because most workstations have no legitimate reason to run ad hoc PowerShell from clipboard pastes. AiTM resistant MFA, ideally FIDO2, neutralizes the most damaging consequence of cookie theft because stolen session cookies cannot be reused without the registered authenticator on subsequent sensitive operations, when the relying party enforces step up.

Session hygiene matters as well. Short session cookie lifetimes, sensitive action step up, and conditional access policies that re evaluate device posture regularly all shrink the window during which a stolen cookie is useful. User awareness training adapted to ClickFix is now essential, since the legacy phishing curriculum focused on email links and attachments does not cover fake CAPTCHAs and Win plus R prompts.

External monitoring closes the loop. Endpoint and network defenses can fail silently, especially on personal devices, contractor laptops, and BYOD endpoints that are out of scope of corporate EDR. Continuous monitoring of Telegram channels, underground forums, and stealer log markets provides the ground truth signal that a credential belonging to your domain has surfaced, regardless of which device leaked it. This is a category of telemetry that internal tools cannot generate on their own.

Stealed and LummaC2 Detection

Stealed observes LummaC2 logs reaching Telegram within minutes of publication. Our ingestion pipeline parses the logs, extracts credentials, cookies, and host metadata, and matches them against monitored domains in close to real time. This complements EDR detection at the endpoint and SIEM correlation in the SOC. It does not replace either of them. The role of external monitoring is to surface what your endpoint stack missed and to provide an independent signal, especially for accounts compromised on devices outside the corporate perimeter.

Frequently Asked Questions

What is LummaC2? LummaC2, also known as Lumma Stealer, is a malware-as-a-service infostealer that emerged in 2022, written primarily in C and targeting Chromium-based browsers, crypto wallets, Discord and Telegram tokens, and desktop files. It is sold on Telegram and Russian-language forums under tiered subscriptions ranging roughly from 250 dollars per month to 20 000 dollars for source-code access, attracting both novice and advanced operators.

Did the May 2025 Microsoft and DOJ takedown stop LummaC2? Operation Lumma in May 2025 seized 2300 plus command-and-control domains in coordination with Europol and disrupted distribution for several months, with reported volume drops around 70 percent. Variants resumed distribution within months under partial rebranding, demonstrating the resilience of MaaS ecosystems against single-event takedowns.

What are the main 2026 infection vectors for LummaC2? ClickFix fake CAPTCHA prompts that trick users into running malicious PowerShell, Google Ads malvertising leading to fake software pages, trojanized GitHub releases, and YouTube cracks distributed via descriptions. ClickFix is the dominant initial access in 2026, leveraging social engineering rather than software exploitation.

How can enterprises protect against LummaC2? Layered defenses including EDR with strong behavioral heuristics, application allowlisting, AiTM-resistant MFA with FIDO2 where possible, short session cookie lifetimes, user awareness on ClickFix, and external monitoring of Telegram and underground forums for credential leaks. Endpoint alone is insufficient since logs reach Telegram within hours.

What are the signs of LummaC2 infection on an endpoint? Unusual access to browser Login Data SQLite, copy of cookies database to an unexpected location, creation and exfiltration of compressed archives via short-lived processes, scheduled tasks for persistence, beacons to obfuscated legitimate domains, and brief PowerShell or rundll32 execution chains right after a CAPTCHA-style page interaction.

Further Reading

• What is an infostealer?
• Infostealer glossary
• Mapping Telegram channels of infostealer logs in 2026
• Top infostealers Q2 2026

External sources worth bookmarking include the Microsoft Security Blog post on the disruption of the Lumma stealer at microsoft.com, the MITRE ATT&CK page for software S1213 at attack.mitre.org, the Sekoia threat research blog at blog.sekoia.io, and Bleeping Computer at bleepingcomputer.com for ongoing coverage of new campaigns.

---

Receive next quarterly report or Discuss your LummaC2 exposure with our CTO.