How do you detect Lumma stealer?

Detect Lumma through its delivery and theft behaviours, not indicators. Watch for ClickFix: a RunMRU registry write containing PowerShell, mshta or curl content, and explorer.exe spawning PowerShell or mshta with a download cradle. Then hunt unsigned or injected processes reading browser credential stores and browser-extension wallet and authenticator data, and non-browser processes contacting public profile pages or messaging services that act as dead-drop resolvers for the C2 address. Restrict the Run dialog and mshta where possible, and rotate credentials on a hit.

Detecting Lumma Stealer (LummaC2): TTPs and Host Behaviours

Lumma (LummaC2) is a native-code infostealer sold as a subscription service. Its operators have leaned heavily on fake CAPTCHA pages that coax users into pasting a command into the Windows Run dialog, a technique widely called ClickFix. Law-enforcement and industry action against Lumma infrastructure in 2025 disrupted it, but affiliates and copycat delivery methods persisted. We keep to documented behaviours and publish no indicators.

Signals at a Glance

Behaviour	Where	ATT&CK
Run dialog history (RunMRU) written with PowerShell, mshta or curl content	Sysmon 13, EDR registry	T1204
explorer.exe spawning PowerShell or mshta with a download cradle	Process creation	T1059.001
Staged payload executed from a user-writable path or injected into a trusted process	Process creation, Sysmon 8/10	T1055
Browser data and browser-extension wallet and 2FA data read by an unsigned process	EDR file access	T1555.003
C2 address resolved from a public profile page or messaging service	Proxy, DNS, EDR network	T1102

ClickFix Delivery

When a user pastes into the Run dialog, Windows records the text in the RunMRU registry key. That gives you a host artifact for a technique that otherwise leaves only a short-lived child process. Alert on the registry write and on the process lineage:

title: Suspicious Command Entered in Run Dialog (ClickFix pattern)
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: '\Explorer\RunMRU'
    Details|contains:
      - 'powershell'
      - 'mshta'
      - 'curl '
      - 'iex'
      - 'http'
  condition: selection
level: high
# tune/validate: IT staff may run admin commands from the Run dialog

Theft and C2 Resolution

Public analyses of Lumma describe reading browser data plus browser-extension storage for wallets and authenticator extensions, and resolving its command-and-control address indirectly, for example from a public profile page or a messaging channel, so that the server can be rotated without rebuilding the sample. Both are visible as a non-browser process talking to services it has no reason to use:

// Microsoft Defender (KQL) - run-dialog lineage and dead-drop style lookups
let RunDialog = DeviceProcessEvents
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe","mshta.exe","cmd.exe")
| where ProcessCommandLine has_any ("http", "iex", "DownloadString", "-enc")
| project DeviceId, RunTime = Timestamp, ProcessCommandLine;
DeviceNetworkEvents
| where RemoteUrl has_any ("steamcommunity.com", "t.me", "telegra.ph")
| where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","steam.exe","telegram.exe")
| join kind=leftouter RunDialog on DeviceId
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl, ProcessCommandLine
// tune/validate: dead-drop service choice varies by build; widen the domain list from current reporting

Restrict the Run dialog and mshta.exe with policy or application control where the business allows it, and train users on the paste-a-command lure.
Hunt extension data access (the browser extension settings folders) as well as the main credential stores.
On a hit, rotate credentials, revoke sessions and move wallet funds if extension wallets were present.

Vetted sources

Use SigmaHQ and Elastic detections for RunMRU abuse and suspicious PowerShell from explorer.exe, vendor and CERT write-ups on Lumma and ClickFix, and the MITRE ATT&CK software page. No indicators are published here by design; consume current ones from a vetted feed and baseline your own admin behaviour.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

ClickFix Delivery

Theft and C2 Resolution

Build Detections That Fire

Infostealer Detection

Detection Hub

StealC Detection

RedLine Detection