Distribution of LummaC2 Infostealer Based on Legitimate Programs

LummaC2 is an actively distributed infostealer that exfiltrates browser credentials, email data, cryptocurrency wallet information, and auto-login program data to attacker C2 servers. Threat actors are embedding the malware into legitimate executables (growing sections and modifying code paths) and disguising samples with legitimate version, icon, and certificate metadata to evade detection; the report documents infection flows, sample behaviors, and supplies MD5 hashes and C2 URLs for detection and blocking.