en
LummaC2Lumma StealerLumma (also known as LummaC2 and Lumma Stealer) is an information-stealing malware family operating under the MaaS model. Lumma targets browser credentials, cryptocurrency wallets, Steam/Telegram/Discord session tokens, seed phrases and 2FA codes. As of 11/10/2026, CyStack's research records 9 variants distributed through 3 channels, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
Lumma C2 (LummaC2) logs. The panel writes System.txt with a
YAML-like dash-prefix list (- LummaC2 Build:,
- Configuration:, etc.) and a distinctive (sig:UNIX.HEX)
signature on the Time: line. Build banners reference the
@lummanowork channel; the panel is sold MaaS via
@lummamarketplace_bot.
3 distinct distribution channels recorded for this malware
| Panel name | Distribution channel | Confidence |
|---|---|---|
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| — |
| Telegram |
| High |
| — | Telegram | High |
| br******** | Telegram | High |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
9 variants recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
01e793c... | 1 | High |
098b5cb... | 7,369 | High |
3c4495c... | 1 | High |
41473f8... | 206 | High |
7682ef5... | 3 | High |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
- Date : <value>- Configuration:- Path: <value> - OS Version: <value>- Local Date: <value>- Time Zone: <value>- Install Date: <value>- Elevated: <value>- Computer: <value>- User: <value>- Domain:- Hostname: <value>- NetBIOS: <value>- Language: <value>- Anti Virus:- HWID: <value>- RAM Size: <value>- CPU Vendor: <value>- CPU Name: <value>- CPU Threads: <value>- CPU Cores: <value>- GPU:- Display resolution: <value> - IP Address: <value>- Time: <value>- Country: <value>
