Lumma Stealer – Tracking distribution channels

This report analyzes Lumma Stealer, an actively distributed information-stealer marketed as LummaC2, focusing on a fake-CAPTCHA campaign that tricks users into executing clipboard-pasted PowerShell or mshta-based commands. It documents the full infection chains (CDN-hosted scripts, ZIP extraction, NSIS/AutoIt loaders, overlay injection, DLL sideloading), anti-analysis and persistence techniques, C2 communication patterns, and provides IoCs observed during incident response to assist detection and mitigation.