# You Are the Exploit Based on FBI/CISA Joint Advisory AA25-141B Forget zero-days. LummaC2 doesn't need one. It asks you to press three keys -- and you launch it yourself. This is the anatomy of one of 2025's most active infostealers, seen through a defender's lens.

21,000+

Marketplace log listings in Q2 2024 alone

71.7%

Year-over-year growth in criminal forum listings

2022

First appeared on Russian-language cybercriminal forums

May 2025

Latest confirmed activity (FBI/CISA advisory)

## **What even is LummaC2?** LummaC2 is a Malware-as-a-Service (MaaS) infostealer -- meaning anyone with enough cryptocurrency and bad intent can rent it. Operators purchase access, configure what to steal, and deploy campaigns at scale without ever writing a line of malware code themselves. Its power isn't technical sophistication. It's a ruthlessly modular design paired with a social engineering trick so simple it's almost embarrassing: it asks the victim to do all the work. ## **The ClickFix Attack: Three keystrokes to compromise** The ClickFix technique is the infection vector that made Lumma dominant. Instead of silently exploiting a browser vulnerability, it exploits something much harder to patch: human trust.

1	User searches for software or a service	Attacker-controlled pages rank in search results, sometimes through malvertising or SEO poisoning.
2	User lands on a page with a fake CAPTCHA	Looks completely legitimate. Same reCAPTCHA styling. 'Verify you are human to continue.'
3	Page silently writes a PowerShell command to the clipboard	JavaScript on the page sets the clipboard content invisibly. The user has no idea it's happened.
4	User is instructed: Win+R -> Ctrl+V -> Enter	Opens the Windows Run dialog, pastes the attacker's Base64-encoded command, and executes it. No exploit needed.
5	PowerShell fires, Lumma downloads and installs	A Base64-encoded PowerShell command fetches and launches the LummaC2 payload. The system is now compromised.

**DETECTION OPPORTUNITY** Watch for powershell.exe spawning immediately after browser activity or Windows Run dialog usage. This behavior is unusual and can be caught with process-lineage monitoring -- even when the file hash is completely unknown. From a detection engineering perspective, this is a textbook 'living off the land' technique. No suspicious binaries dropped at rest. No exploit shellcode. Just Windows doing exactly what it was designed to do -- at the attacker's direction. ## **Inside the malware: six execution stages** Once active, Lumma doesn't spray and pray. It behaves like a well-engineered application, moving through distinct stages with a clean separation between delivery and instruction -- making it adaptable across campaigns.

1	Execute and load	Malware loads into memory. Initial checks and environment setup begin.
2	Decrypt internal strings	Encrypted strings -- domains, API names, paths -- are decrypted at runtime to evade static AV and EDR.
3	Discover active C2	Decrypts a list of C2 domains and sends POST requests until a live server responds. Stores the working domain.
4	Receive configuration	Downloads an encrypted JSON config from C2, parses opcodes, determines what to steal and how.
5	Collect data	Gathers browser data, cookies, passwords, crypto wallets, MFA details, screenshots -- per operator config.
6	Exfiltrate and exit	Compresses and encrypts stolen data, sends it via HTTP POST to C2. Can self-delete to erase evidence.

**ANALYST NOTE: THE DEVELOPER FAILSAFE** Lumma checks the victim's username and computer name by hashing them and comparing against two hardcoded values. If they match -- likely the developer's own machine -- the malware terminates immediately. The algorithm is one-way, so analysts cannot reverse it to learn the attacker's own credentials. A deliberate, professional engineering choice. ## **Why session cookies are worth more than passwords** Most people think credential theft means stealing passwords. Lumma knows better. The real prize in 2025 is the authenticated session cookie.

1	User logs into Microsoft 365	Standard login with valid credentials and MFA challenge completed.
2	Browser stores the session cookie	An authentication token is saved locally in the browser's credential store -- this is the target.
3	Lumma accesses browser storage and steals the cookie	Targets Chromium and Mozilla credential stores silently, without triggering any alert.
4	Attacker imports the stolen cookie into their own browser	No password needed. No MFA challenge triggered. The session is already authenticated.
5	Attacker is now inside the account	Email, files, contacts, calendar, integrations -- all exposed without a single login attempt.

This is why modern phishing-resistant MFA matters. Standard TOTP codes do not protect against session hijacking -- the attacker never needs to authenticate, because the session already is authenticated. ## **What else can it steal? The opcode menu** Lumma's C2 sends JSON configurations with opcodes that tell it exactly what to do. Think of it as a task list the operator updates per campaign:

Opcode	Behaviour
Opcode 0	Generic file theft -- any path, extension, recursion depth, and file size the operator defines
Opcode 1	Chromium browser data -- history, cookies, passwords, autofill data, and extensions
Opcode 2	Mozilla browser data -- same as above, with a separate handler for Firefox profiles
Opcode 3	Download and execute a remote file -- via LoadLibraryW() or rundll32.exe
"se": true	Take a screenshot in BMP format and upload directly to C2
"ad": true	Self-delete -- wipe the executable and exit, leaving minimal forensic trace

**ANALYST NOTE: SERVER-SIDE FLEXIBILITY** Because behavior is configured server-side, no two Lumma infections look the same. One campaign may only steal cookies. Another adds screenshot capability and drops a secondary payload. Traditional signature-based detection fails here entirely -- you need behavioral monitoring, not hash matching. ## **MITRE ATT&CK mapping** Lumma maps cleanly to documented MITRE techniques -- useful for validating and stress-testing your existing detection coverage:

Technique	Description
T1566	Phishing -- initial delivery via spearphishing links and email attachments
T1027	Obfuscated files -- Base64 encoding of PowerShell commands to evade static analysis
T1036	Masquerading -- hidden inside spoofed or fake popular software packages
T1140	Deobfuscate/decode -- decrypts C2 domains at runtime, not embedded in the binary
T1012	Query registry -- hashes victim username and computer name via GetUserNameW/GetComputerNameW
T1217	Browser information discovery -- targeted collection of browser cookies, passwords, extensions
T1071.001	C2 over web protocols -- HTTP POST requests to dynamically resolved callback servers
T1119	Automated collection -- sweeps crypto wallets, credentials, screenshots, MFA tokens
T1105	Ingress tool transfer -- downloads additional payloads to compromised systems
TA0010	Exfiltration -- compressed, encrypted data sent to attacker-controlled infrastructure

## **How to actually defend against this** IOCs -- domains, hashes -- are burned the moment they're published. Lumma rotates them constantly. The only durable defense is behavioral. Here's what the FBI and CISA recommend, and why each one works:

Control	Why it works
Application allowlisting	Blocks execution of anything not on an approved list. Catches portable executables that bypass AV -- even heavily obfuscated ones.
Phishing-resistant MFA	Move beyond TOTP. FIDO2/hardware keys cannot be bypassed by a stolen session cookie in the same way SMS or app codes can.
Least privilege + account separation	Standard users shouldn't have registry access or the ability to run arbitrary command-line processes.
Log auditing	Regularly review registry changes and access logs. Lumma leaves footprints -- catch it before exfiltration completes.
Behavioral monitoring	Alert on: powershell.exe spawned by a browser, mshta.exe in unusual chains, processes accessing credential stores then making outbound POST requests.
Network segmentation	DMZ or VPC isolation limits blast radius. Even if Lumma runs, it shouldn't reach sensitive systems without hitting a detection point.

**THE DEFENDER'S MINDSET SHIFT** Stop chasing what Lumma looks like. Start watching how it behaves. Domains rotate. Hashes change. But 'a process accessed browser credential storage and immediately initiated external network communication' is a behavioral pattern that persists across every variant -- and that's where your detections need to live. ## **The bottom line** LummaC2 isn't remarkable because of what it does technically. It's remarkable because it combined social engineering, a modular MaaS architecture, and session cookie theft into a scalable platform that thousands of low-sophistication threat actors can deploy effectively. The ClickFix technique bypasses every perimeter control by simply asking the user to be the exploit. Your EDR can't flag a user pressing Win+R. Your firewall can't block PowerShell that the user themselves launched. The detection surface has shifted -- and defenders still matching IOCs are already behind. Sources: FBI & CISA Joint Cybersecurity Advisory AA25-141B (May 21, 2025) · Microsoft Threat Intelligence -- Lumma disruption and ecosystem analysis (May 2025) · MITRE ATT&CK Enterprise Framework v17 · ReliaQuest contribution acknowledged in advisory