You Are the Exploit
How LummaC2 skipped the zero-day and made you the attack vector.
Based on FBI/CISA Joint Advisory AA25-141B
Forget zero-days. LummaC2 doesn't need one. It asks you to press three keys -- and you launch it yourself. This is the anatomy of one of 2025's most active infostealers, seen through a defender's lens.
21,000+ | Marketplace log listings in Q2 2024 alone | 71.7% | Year-over-year growth in criminal forum listings | 2022 | First appeared on Russian-language cybercriminal forums | May 2025 | Latest confirmed activity (FBI/CISA advisory) |
What even is LummaC2?
LummaC2 is a Malware-as-a-Service (MaaS) infostealer -- meaning anyone with enough cryptocurrency and bad intent can rent it. Operators purchase access, configure what to steal, and deploy campaigns at scale without ever writing a line of malware code themselves.
Its power isn't technical sophistication. It's a ruthlessly modular design paired with a social engineering trick so simple it's almost embarrassing: it asks the victim to do all the work.
The ClickFix Attack: Three keystrokes to compromise
The ClickFix technique is the infection vector that made Lumma dominant. Instead of silently exploiting a browser vulnerability, it exploits something much harder to patch: human trust.
1 | User searches for software or a service | Attacker-controlled pages rank in search results, sometimes through malvertising or SEO poisoning. |
2 | User lands on a page with a fake CAPTCHA | Looks completely legitimate. Same reCAPTCHA styling. 'Verify you are human to continue.' |
3 | Page silently writes a PowerShell command to the clipboard | JavaScript on the page sets the clipboard content invisibly. The user has no idea it's happened. |
4 | User is instructed: Win+R -> Ctrl+V -> Enter | Opens the Windows Run dialog, pastes the attacker's Base64-encoded command, and executes it. No exploit needed. |
5 | PowerShell fires, Lumma downloads and installs | A Base64-encoded PowerShell command fetches and launches the LummaC2 payload. The system is now compromised. |
DETECTION OPPORTUNITY
Watch for powershell.exe spawning immediately after browser activity or Windows Run dialog usage. This behavior is unusual and can be caught with process-lineage monitoring -- even when the file hash is completely unknown.
From a detection engineering perspective, this is a textbook 'living off the land' technique. No suspicious binaries dropped at rest. No exploit shellcode. Just Windows doing exactly what it was designed to do -- at the attacker's direction.
Inside the malware: six execution stages
Once active, Lumma doesn't spray and pray. It behaves like a well-engineered application, moving through distinct stages with a clean separation between delivery and instruction -- making it adaptable across campaigns.
1 | Execute and load | Malware loads into memory. Initial checks and environment setup begin. |
2 | Decrypt internal strings | Encrypted strings -- domains, API names, paths -- are decrypted at runtime to evade static AV and EDR. |
3 | Discover active C2 | Decrypts a list of C2 domains and sends POST requests until a live server responds. Stores the working domain. |
4 | Receive configuration | Downloads an encrypted JSON config from C2, parses opcodes, determines what to steal and how. |
5 | Collect data | Gathers browser data, cookies, passwords, crypto wallets, MFA details, screenshots -- per operator config. |
6 | Exfiltrate and exit | Compresses and encrypts stolen data, sends it via HTTP POST to C2. Can self-delete to erase evidence. |
ANALYST NOTE: THE DEVELOPER FAILSAFE
Lumma checks the victim's username and computer name by hashing them and comparing against two hardcoded values. If they match -- likely the developer's own machine -- the malware terminates immediately. The algorithm is one-way, so analysts cannot reverse it to learn the attacker's own credentials. A deliberate, professional engineering choice.
Why session cookies are worth more than passwords
Most people think credential theft means stealing passwords. Lumma knows better. The real prize in 2025 is the authenticated session cookie.
1 | User logs into Microsoft 365 | Standard login with valid credentials and MFA challenge completed. |
2 | Browser stores the session cookie | An authentication token is saved locally in the browser's credential store -- this is the target. |
3 | Lumma accesses browser storage and steals the cookie | Targets Chromium and Mozilla credential stores silently, without triggering any alert. |
4 | Attacker imports the stolen cookie into their own browser | No password needed. No MFA challenge triggered. The session is already authenticated. |
5 | Attacker is now inside the account | Email, files, contacts, calendar, integrations -- all exposed without a single login attempt. |
This is why modern phishing-resistant MFA matters. Standard TOTP codes do not protect against session hijacking -- the attacker never needs to authenticate, because the session already is authenticated.
What else can it steal? The opcode menu
Lumma's C2 sends JSON configurations with opcodes that tell it exactly what to do. Think of it as a task list the operator updates per campaign:
Opcode | Behaviour |
Opcode 0 | Generic file theft -- any path, extension, recursion depth, and file size the operator defines |
Opcode 1 | Chromium browser data -- history, cookies, passwords, autofill data, and extensions |
Opcode 2 | Mozilla browser data -- same as above, with a separate handler for Firefox profiles |
Opcode 3 | Download and execute a remote file -- via LoadLibraryW() or rundll32.exe |
"se": true | Take a screenshot in BMP format and upload directly to C2 |
"ad": true | Self-delete -- wipe the executable and exit, leaving minimal forensic trace |
ANALYST NOTE: SERVER-SIDE FLEXIBILITY
Because behavior is configured server-side, no two Lumma infections look the same. One campaign may only steal cookies. Another adds screenshot capability and drops a secondary payload. Traditional signature-based detection fails here entirely -- you need behavioral monitoring, not hash matching.
MITRE ATT&CK mapping
Lumma maps cleanly to documented MITRE techniques -- useful for validating and stress-testing your existing detection coverage:
Technique | Description |
T1566 | Phishing -- initial delivery via spearphishing links and email attachments |
T1027 | Obfuscated files -- Base64 encoding of PowerShell commands to evade static analysis |
T1036 | Masquerading -- hidden inside spoofed or fake popular software packages |
T1140 | Deobfuscate/decode -- decrypts C2 domains at runtime, not embedded in the binary |
T1012 | Query registry -- hashes victim username and computer name via GetUserNameW/GetComputerNameW |
T1217 | Browser information discovery -- targeted collection of browser cookies, passwords, extensions |
T1071.001 | C2 over web protocols -- HTTP POST requests to dynamically resolved callback servers |
T1119 | Automated collection -- sweeps crypto wallets, credentials, screenshots, MFA tokens |
T1105 | Ingress tool transfer -- downloads additional payloads to compromised systems |
TA0010 | Exfiltration -- compressed, encrypted data sent to attacker-controlled infrastructure |
How to actually defend against this
IOCs -- domains, hashes -- are burned the moment they're published. Lumma rotates them constantly. The only durable defense is behavioral. Here's what the FBI and CISA recommend, and why each one works:
Control | Why it works |
Application allowlisting | Blocks execution of anything not on an approved list. Catches portable executables that bypass AV -- even heavily obfuscated ones. |
Phishing-resistant MFA | Move beyond TOTP. FIDO2/hardware keys cannot be bypassed by a stolen session cookie in the same way SMS or app codes can. |
Least privilege + account separation | Standard users shouldn't have registry access or the ability to run arbitrary command-line processes. |
Log auditing | Regularly review registry changes and access logs. Lumma leaves footprints -- catch it before exfiltration completes. |
Behavioral monitoring | Alert on: powershell.exe spawned by a browser, mshta.exe in unusual chains, processes accessing credential stores then making outbound POST requests. |
Network segmentation | DMZ or VPC isolation limits blast radius. Even if Lumma runs, it shouldn't reach sensitive systems without hitting a detection point. |
THE DEFENDER'S MINDSET SHIFT
Stop chasing what Lumma looks like. Start watching how it behaves. Domains rotate. Hashes change. But 'a process accessed browser credential storage and immediately initiated external network communication' is a behavioral pattern that persists across every variant -- and that's where your detections need to live.
The bottom line
LummaC2 isn't remarkable because of what it does technically. It's remarkable because it combined social engineering, a modular MaaS architecture, and session cookie theft into a scalable platform that thousands of low-sophistication threat actors can deploy effectively. The ClickFix technique bypasses every perimeter control by simply asking the user to be the exploit. Your EDR can't flag a user pressing Win+R. Your firewall can't block PowerShell that the user themselves launched. The detection surface has shifted -- and defenders still matching IOCs are already behind.
Sources: FBI & CISA Joint Cybersecurity Advisory AA25-141B (May 21, 2025) · Microsoft Threat Intelligence -- Lumma disruption and ecosystem analysis (May 2025) · MITRE ATT&CK Enterprise Framework v17 · ReliaQuest contribution acknowledged in advisory
