IOCs by window
0
IOCs tagged #Lumma
0
IOCs tagged #Lumma
0
IOCs tagged #Lumma
292
IOCs tagged #Lumma
Counts as of 2026-10-28. Regenerated daily.
About #Lumma
- Type: Infostealer-as-a-service, sold since 2022 on Russian-language forums.
- Steals: Browser credentials, cookies, crypto wallets, autofill, FTP / SSH keys, MFA seeds.
- Scale: Monthly plans. One of the highest-volume stealers since 2024.
- Delivery: Cracked software (SEO), ClickFix fake CAPTCHA, YouTube comments.
- Signals: Non-browser reads of browser data. Short-lived panel domains. AES over HTTPS POST.
- Takedowns: Microsoft and EU + US law enforcement repeatedly disrupt the panels.
- References: MITRE ATT&CK S1138 · Malpedia.
Recent IOCs tagged #Lumma
No IOCs tagged #Lumma in the past 30 days. Year total: 292. Older data: api.tweetfeed.live/v1/year (all tags, filter for #Lumma).
Related tags
Frequently asked questions
What is Lumma stealer?
Lumma (LummaC2) is an infostealer-as-a-service sold since 2022, tracked by MITRE ATT&CK as S1138. It steals browser credentials, crypto wallets and MFA seeds.
How is Lumma typically delivered?
Most often through SEO-poisoned cracked-software downloads and ClickFix fake-CAPTCHA pages. YouTube-comment loaders that point to PasteBin scripts are also frequent.
How is this list updated?
The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.
What is the license? Can I use this commercially?
Yes. All IOC data, including this Lumma subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.
License
Lumma IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.