Lumma Stealer: What It Steals and How to Remove It - 2

Do it yourself · free Remove Lumma Stealer (LummaC2) yourself 5 steps, 15 minutes, no software needed.

Lumma Stealer (LummaC2): summary

Facts checked on 23 October 2026 against Microsoft Threat Intelligence (21 May 2025), Microsoft's Digital Crimes Unit announcement (21 May 2025), MITRE ATT&CK S1213, Microsoft Learn on Defender Offline and the FTC.

Our radar logged abuse.ch ThreatFox entries for the name on 16, 17 and 18 October 2026; we did not open them. We downloaded no file and infected no PC; the steps follow Microsoft and FTC pages and were not tried on a live infection.

What Lumma Stealer is, and the question people ask it

Yes, Lumma Stealer is malware, and it is dangerous for the person whose PC it runs on. It is an information stealer: its job is to copy what is saved on your computer and send it away, quietly, so that someone can use your accounts. Reading it or seeing its name in a log does not mean you are infected.

1 What it is Microsoft describes Lumma Stealer, also called LummaC2, as an infostealer that can take data from browsers and applications, including cryptocurrency wallets, and can install other malware. Microsoft tracks its developer, its command servers and its sales platform under the name Storm-2477. MITRE ATT&CK lists it as a Windows program that has been in use since at least 2022.

Microsoft describes Lumma Stealer, also called LummaC2, as an infostealer that can take data from browsers and applications, including cryptocurrency wallets, and can install other malware. Microsoft tracks its developer, its command servers and its sales platform under the name Storm-2477. MITRE ATT&CK lists it as a Windows program that has been in use since at least 2022.

2 How it is sold Lumma is malware as a service. The developer sells access to a control panel where buyers, whom Microsoft calls affiliates, build their own copy of the program, manage the servers it talks to and read the stolen data. Microsoft says the developer, who goes by Shamel, sells tiered access through Telegram and Russian language forums. That is why many different people spread it in many different ways.

Lumma is malware as a service. The developer sells access to a control panel where buyers, whom Microsoft calls affiliates, build their own copy of the program, manage the servers it talks to and read the stolen data. Microsoft says the developer, who goes by Shamel, sells tiered access through Telegram and Russian language forums. That is why many different people spread it in many different ways.

3 Why that matters to you There is no single Lumma website, email or file to avoid. Whoever buys a copy chooses the bait. Microsoft found it in phishing emails, ads, cracked software, hacked websites and fake CAPTCHA pages, and says it was also used by groups linked to ransomware attacks, among them Octo Tempest.

Why that matters to you

There is no single Lumma website, email or file to avoid. Whoever buys a copy chooses the bait. Microsoft found it in phishing emails, ads, cracked software, hacked websites and fake CAPTCHA pages, and says it was also used by groups linked to ransomware attacks, among them Octo Tempest.

4 What we could not confirm Our radar logged entries for Lumma Stealer on the abuse.ch ThreatFox list on 16, 17 and 18 October 2026. We did not open those entries, so we cannot tell you which servers or files they point to. We found no public report of one single address for this guide, and we did not test any Lumma file.

What we could not confirm

Our radar logged entries for Lumma Stealer on the abuse.ch ThreatFox list on 16, 17 and 18 October 2026. We did not open those entries, so we cannot tell you which servers or files they point to. We found no public report of one single address for this guide, and we did not test any Lumma file.

What Lumma Stealer (LummaC2) does on an infected PC

What we checked on 23 October 2026, and what we could not

This guide is a malware family, not one web address, so there is no site test and no screenshot of a page. We read Microsoft's analysis, Microsoft's court action announcement and the MITRE entry, and we looked at what our own radar saw. We did not download or run any Lumma file and we infected no PC.

What our check covers, 23 October 2026

Is it real malware? Yes. Microsoft, MITRE and the US court order of May 2025 all treat it as a malicious program.

Is it still active in October 2026? Our radar logged ThreatFox entries for it on 16, 17 and 18 October 2026, which suggests indicators are still being reported. We did not open them, and we have not read a source on how many PCs it infects today.

Did the 2025 takedown end it? Unknown to us. Microsoft says the infrastructure uses short lived domains and fallback servers, which is built to survive blocking. We read no source that says it was ended.

Our own test of a Lumma file None. We did not download or run anything. The advice below follows Microsoft and the FTC and was not tried on an infected PC.

Dangerous: treat a PC that ran it as watched The rating comes from Microsoft's and MITRE's descriptions, not from a test of ours. A clean scan does not prove a PC was never hit, because the program runs in memory and is built to avoid scanners.

Lumma Stealer from 2022 to October 2026: the dates we can confirm

Most of what is public happened in spring 2025, when Microsoft measured the spread and went to court. The October 2026 line is only what our radar logged.

2022 First use on record MITRE ATT&CK says Lumma Stealer has been in use since at least 2022. Microsoft says it has been sold on underground forums since at least 2022.

MITRE ATT&CK says Lumma Stealer has been in use since at least 2022. Microsoft says it has been sold on underground forums since at least 2022.

16 March to 16 May 2025 394,000 infected PCs counted In those two months Microsoft identified more than 394,000 Windows computers around the world infected with Lumma.

16 March to 16 May 2025

394,000 infected PCs counted

In those two months Microsoft identified more than 394,000 Windows computers around the world infected with Lumma.

Early April 2025 Hacked sites and a blockchain trick Microsoft describes compromised websites whose JavaScript asked smart contracts on the Binance Smart Chain for the fake CAPTCHA page. The technique is called EtherHiding. Blocking a domain does not stop it, because the instructions live on a blockchain.

Hacked sites and a blockchain trick

Microsoft describes compromised websites whose JavaScript asked smart contracts on the Binance Smart Chain for the fake CAPTCHA page. The technique is called EtherHiding. Blocking a domain does not stop it, because the instructions live on a blockchain.

7 April 2025 Invoice emails in Canada Thousands of emails with invoice lures for a fitness plan or an online education platform carried personal subject lines and links through a traffic direction system to a fake CAPTCHA page. The chain ended with a Lumma program that also carried a second malware called Xworm.

Invoice emails in Canada

Thousands of emails with invoice lures for a fitness plan or an online education platform carried personal subject lines and links through a traffic direction system to a fake CAPTCHA page. The chain ended with a Lumma program that also carried a second malware called Xworm.

13 May 2025 Microsoft goes to court Microsoft's Digital Crimes Unit filed legal action in the Northern District of Georgia. The order let it seize, suspend or block 2,300 domains, of which over 1,300 were seized or transferred to Microsoft and pointed at its sinkholes.

Microsoft goes to court

Microsoft's Digital Crimes Unit filed legal action in the Northern District of Georgia. The order let it seize, suspend or block 2,300 domains, of which over 1,300 were seized or transferred to Microsoft and pointed at its sinkholes.

21 May 2025 The disruption is announced Microsoft announced the action with the US Department of Justice, Europol's EC3, Japan's JC3 and industry partners including ESET, Bitsight, Lumen and Cloudflare, and published its technical analysis the same day.

The disruption is announced

Microsoft announced the action with the US Department of Justice, Europol's EC3, Japan's JC3 and industry partners including ESET, Bitsight, Lumen and Cloudflare, and published its technical analysis the same day.

16 to 18 October 2026 Our radar logs new ThreatFox entries The abuse.ch ThreatFox list carries entries tagged Lumma Stealer on three days in our data. We did not read them. They show that the name is still being reported; they do not tell us how widespread it is.

16 to 18 October 2026

Our radar logs new ThreatFox entries

The abuse.ch ThreatFox list carries entries tagged Lumma Stealer on three days in our data. We did not read them. They show that the name is still being reported; they do not tell us how widespread it is.

What the dates suggest, and what they do not: a large takedown in 2025 and fresh reports in 2026 fit a tool that can be rebuilt on new servers, but that is our reading. We found no source that measures Lumma's size after May 2025.

How Lumma Stealer gets onto a PC

Lumma needs you to start something once, or to land on a page that does it for you. Microsoft lists six routes, and one campaign often mixes several.

1 Phishing emails The emails copy known brands and press for speed, for example a fake hotel booking or a cancellation notice. The link leads to a copied site or to a server that hands out the malware.

The emails copy known brands and press for speed, for example a fake hotel booking or a cancellation notice. The link leads to a copied site or to a server that hands out the malware.

2 ads for software Microsoft saw fake ads for searches such as Notepad++ or a Chrome update. The link leads to a clone of the vendor's page, and the download is the stealer. Always check who paid for the top result.

ads for software

Microsoft saw fake ads for searches such as Notepad++ or a Chrome update. The link leads to a clone of the vendor's page, and the download is the stealer. Always check who paid for the top result.

3 Hacked legitimate websites Attackers add JavaScript to a real site. The script either delivers a file or shows the lure, so a visitor sees a site they trust.

Hacked legitimate websites

Attackers add JavaScript to a real site. The script either delivers a file or shows the lure, so a visitor sees a site they trust.

4 Cracked and pirated software Microsoft says cracked programs with Lumma inside are shared on file sharing platforms. The installer often shows nothing odd and runs the stealer silently after you start it.

Cracked and pirated software

Microsoft says cracked programs with Lumma inside are shared on file sharing platforms. The installer often shows nothing odd and runs the stealer silently after you start it.

5 GitHub and the fake CAPTCHA (ClickFix) Public repositories can host disguised scripts and programs. In the fake CAPTCHA trick, a page that says I am not a robot tells you to press a key combination, paste a command into the Windows Run box and press Enter. Microsoft says the command is often Base64 text that starts Lumma in memory.

GitHub and the fake CAPTCHA (ClickFix)

Public repositories can host disguised scripts and programs. In the fake CAPTCHA trick, a page that says I am not a robot tells you to press a key combination, paste a command into the Windows Run box and press Enter. Microsoft says the command is often Base64 text that starts Lumma in memory.

6 Dropped by other malware Microsoft names DanaBot as a loader that delivered Lumma as a second payload. A PC with one infection can pick up the .

Dropped by other malware

Microsoft names DanaBot as a loader that delivered Lumma as a second payload. A PC with one infection can pick up the .

In the early April 2025 campaign Microsoft quotes, the pasted command used the Windows tool mshta to fetch a file from check.foquh[.]icu. That address is written defanged here on purpose. It is one example from one campaign, not a list to check your PC against.

What Lumma Stealer (LummaC2) can steal or download

What Lumma Stealer takes from a Windows PC

Lumma reads a settings file from its control server that says what to collect, so different copies take different things. The categories below are the ones Microsoft names.

Saved browser passwords

Wallet browser extensions (MetaMask, Electrum, Exodus)

VPN configuration files (.ovpn)

Documents (.pdf, .docx, .rtf)

Computer and software details

Extra malware, a clipboard stealer, coin miners

The cookie theft is the part people miss. A session cookie can let someone use your account without the password and sometimes without the second factor, because the site thinks it is still you. That is why signing out of all sessions matters as much as changing the password.

How Lumma Stealer tries not to be found

Microsoft's analysis spends most of its length on hiding. This is why we say a clean scan clears nothing.

What this can cost you

Seeing the name costs nothing. The risks below apply to a PC where Lumma actually ran.

High Account takeover Saved passwords and live session cookies let a stranger enter your email, social media, shop and work accounts. Email is the most serious, because it resets everything else.

Saved passwords and live session cookies let a stranger enter your email, social media, shop and work accounts. Email is the most serious, because it resets everything else.

High Stolen crypto Wallet files and wallet extensions are named targets. Funds moved out of a wallet cannot be called back.

Wallet files and wallet extensions are named targets. Funds moved out of a wallet cannot be called back.

High Work and company access VPN files and saved logins on a work PC can open the way to a company network. Microsoft says ransomware linked groups used Lumma, so a stolen login can be the first step of a bigger attack.

Work and company access

VPN files and saved logins on a work PC can open the way to a company network. Microsoft says ransomware linked groups used Lumma, so a stolen login can be the first step of a bigger attack.

Medium Bank and card details Microsoft's court announcement lists payment card data and bank account details among what the operation steals.

Bank and card details

Microsoft's court announcement lists payment card data and bank account details among what the operation steals.

Medium More malware Lumma can install other programs, including a clipboard stealer and coin miners, so the PC may hold more than one infection.

Lumma can install other programs, including a clipboard stealer and coin miners, so the PC may hold more than one infection.

Low Nothing, if you only read the name A name in a warning, a log or a news page is not an infection.

Nothing, if you only read the name

A name in a warning, a log or a news page is not an infection.

What you may notice, and what you may not

An infostealer is built to be quiet and short. Many victims see nothing on the PC and learn it from their accounts.

How to check the PC for Lumma Stealer (LummaC2)

If you pasted a command from a fake CAPTCHA

Treat this as an infection even if nothing seemed to happen. The command starts the loader in memory, and the theft can finish within moments.

1 Disconnect now Turn off Wi-Fi or unplug the network cable. The stealer needs the connection to send data away.

Turn off Wi-Fi or unplug the network cable. The stealer needs the connection to send data away.

2 Do not close the question, answer it Think what the page asked: open Run with the Windows key and R, paste, press Enter. If you did that, the sections apply to you in full.

Do not close the question, answer it

Think what the page asked: open Run with the Windows key and R, paste, press Enter. If you did that, the sections apply to you in full.

3 See what Run remembers Microsoft's alerts include Suspicious command in RunMRU registry, and its hunting query reads the RunMRU key, where Windows stores what was typed into Run. The usual path is HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. That path comes from general Windows knowledge, not from the pages we read. Look, do not delete, and note any long command that mentions mshta, powershell or a web address.

See what Run remembers

Microsoft's alerts include Suspicious command in RunMRU registry, and its hunting query reads the RunMRU key, where Windows stores what was typed into Run. The usual path is HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. That path comes from general Windows knowledge, not from the pages we read. Look, do not delete, and note any long command that mentions mshta, powershell or a web address.

4 Go to the account steps from another device Do not log in on this PC. Use a phone or another computer that you trust and follow the plan below.

Go to the account steps from another device

Do not log in on this PC. Use a phone or another computer that you trust and follow the plan below.

Check your PC before you delete anything

None of these checks removes anything. They tell you how worried to be. Keep the PC offline while you do them if you think it ran Lumma.

1 Open Protection history In Windows Security > Virus & threat protection > Protection history , look for LummaStealer, ClickFix, FakeCaptcha, Powdow or Shaolaod, which are names Microsoft lists. Also look at what was blocked or quarantined around the time you ran something. Microsoft says the results of an offline scan also appear there.

Open Protection history

In Windows Security > Virus & threat protection > Protection history , look for LummaStealer, ClickFix, FakeCaptcha, Powdow or Shaolaod, which are names Microsoft lists. Also look at what was blocked or quarantined around the time you ran something. Microsoft says the results of an offline scan also appear there.

2 Look at Startup apps Open Settings > Apps > Startup and look for names you did not install. MITRE lists a registry Run key or the Startup folder as a way Lumma can persist, though Microsoft's analysis names no method. A clean list does not clear the PC.

Open Settings > Apps > Startup and look for names you did not install. MITRE lists a registry Run key or the Startup folder as a way Lumma can persist, though Microsoft's analysis names no method. A clean list does not clear the PC.

3 Open Task Manager Press Ctrl, Shift and Esc and sort by network or CPU. Look for msbuild.exe, regasm.exe or regsvcs.exe running with no reason, since Microsoft says the loader may inject into them. They are genuine Windows files, so use right click, Open file location , to see where they run from.

Press Ctrl, Shift and Esc and sort by network or CPU. Look for msbuild.exe, regasm.exe or regsvcs.exe running with no reason, since Microsoft says the loader may inject into them. They are genuine Windows files, so use right click, Open file location , to see where they run from.

4 Look at installed apps Open Settings > Apps > Installed apps and sort by install date. A program you installed from a crack or an ad around the time of the problem is the one to note. Do not uninstall yet; write the name.

Look at installed apps

Open Settings > Apps > Installed apps and sort by install date. A program you installed from a crack or an ad around the time of the problem is the one to note. Do not uninstall yet; write the name.

5 Check your accounts from another device Look at sign in activity for email, bank, social and exchange accounts, and at crypto balances. This is faster and more telling than any file check. Also look in your email settings for forwarding rules you did not make, which the FTC names as a sign of access.

Check your accounts from another device

Look at sign in activity for email, bank, social and exchange accounts, and at crypto balances. This is faster and more telling than any file check. Also look in your email settings for forwarding rules you did not make, which the FTC names as a sign of access.

6 A scan helps, but it does not clear the PC Microsoft Defender or another product can find known files and behaviour. A clean result is one data point, like a quiet site test. The order of the plan below is our judgement from Microsoft and FTC pages, not a tested result.

A scan helps, but it does not clear the PC

Microsoft Defender or another product can find known files and behaviour. A clean result is one data point, like a quiet site test. The order of the plan below is our judgement from Microsoft and FTC pages, not a tested result.

What antivirus calls Lumma Stealer

Microsoft Defender uses several names because Lumma comes in different file types. Other vendors use their own names, which we did not read.

How to remove Lumma Stealer (LummaC2)

How to remove Lumma Stealer

A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.

1 Step 1 : Delete scheduled tasks that bring it back Programs like Lumma Stealer add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler , open Task Scheduler Library and sort by Last Run Time to see what ran recently. On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete . Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 1 : Delete scheduled tasks that bring it back

Programs like Lumma Stealer add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler , open Task Scheduler Library and sort by Last Run Time to see what ran recently.

On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete .

Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.

Full procedure with screenshots: Remove what malware leaves behind in Windows

2 Step 2 : Remove it from startup Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component. Right-click an entry and choose Open file location to see where it runs from: programs in %AppData% or %Temp% deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check. Full procedure with screenshots: Stop apps from opening at startup On uGetFix

Step 2 : Remove it from startup

Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.

Right-click an entry and choose Open file location to see where it runs from: programs in %AppData% or %Temp% deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.

Full procedure with screenshots: Stop apps from opening at startup On uGetFix

3 Step 3 : Delete the folders left behind Uninstalling often leaves the program's folders, and some threats reinstall themselves from them. Press Windows + R , type %LocalAppData% and press Enter, then do the same for %AppData% and %ProgramData%, and look for folders named after Lumma Stealer, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too. If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 3 : Delete the folders left behind

Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.

Press Windows + R , type %LocalAppData% and press Enter, then do the same for %AppData% and %ProgramData%, and look for folders named after Lumma Stealer, its publisher or created on the day the problem started.

Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.

If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.

Full procedure with screenshots: Remove what malware leaves behind in Windows

4 Step 4 : Scan the PC, then run the offline scan A scan finds the parts of Lumma Stealer that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options , start a Full scan and quarantine what it reports. Follow it with Microsoft Defender Antivirus (offline scan) > Scan now , which restarts the PC and checks the disk while Windows and the malware are not running. It takes 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean. Full procedure with screenshots: Run a Microsoft Defender Offline scan

Step 4 : Scan the PC, then run the offline scan

A scan finds the parts of Lumma Stealer that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options , start a Full scan and quarantine what it reports.

Follow it with Microsoft Defender Antivirus (offline scan) > Scan now , which restarts the PC and checks the disk while Windows and the malware are not running.

It takes 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.

Full procedure with screenshots: Run a Microsoft Defender Offline scan

5 Step 5 : Change passwords from another device and sign out other sessions Lumma Stealer can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft. Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules. Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean. Full procedure with screenshots: Turn on two-step verification / secure a hacked account

Step 5 : Change passwords from another device and sign out other sessions

Lumma Stealer can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.

Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.

Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.

Full procedure with screenshots: Turn on two-step verification / secure a hacked account

If you use a Mac, an iPhone or an Android phone

Every source we read describes Lumma Stealer as a Windows program. We found no source that says it runs on anything else.

After removal: passwords, accounts and prevention

If Lumma ran: protect what was taken, then clean the PC

Order matters. Accounts first, from another device, because the stealer already has what was on this PC and may still be watching new logins.

1 Disconnect the PC Turn off Wi-Fi or unplug the cable so nothing more is sent. Use the PC for nothing else until it is clean.

Turn off Wi-Fi or unplug the cable so nothing more is sent. Use the PC for nothing else until it is clean.

2 Change passwords from a clean device, email first The FTC says to change a password you still can to a long, unique one and then sign out of all devices. Start with your email, because it resets every other account, then bank, work, cloud storage and crypto. Do not change them on the suspect PC, since a stealer or a leftover tool may see the new ones.

Change passwords from a clean device, email first

The FTC says to change a password you still can to a long, unique one and then sign out of all devices. Start with your email, because it resets every other account, then bank, work, cloud storage and crypto. Do not change them on the suspect PC, since a stealer or a leftover tool may see the new ones.

3 Sign out everywhere and turn on two factor sign in Signing out of all sessions removes anyone who holds a stolen cookie. The FTC also says to turn on two factor authentication, so a stolen password alone is not enough. Microsoft recommends phishing resistant methods such as FIDO2 security keys or passkeys over text message codes.

Sign out everywhere and turn on two factor sign in

Signing out of all sessions removes anyone who holds a stolen cookie. The FTC also says to turn on two factor authentication, so a stolen password alone is not enough. Microsoft recommends phishing resistant methods such as FIDO2 security keys or passkeys over text message codes.

4 Update recovery details and look for forwarding rules Change the recovery email and phone number if they could have been read. Check your mail settings for forwarding rules you did not create, since the FTC says attackers use them to send your messages elsewhere.

Update recovery details and look for forwarding rules

Change the recovery email and phone number if they could have been read. Check your mail settings for forwarding rules you did not create, since the FTC says attackers use them to send your messages elsewhere.

5 Move crypto first if a wallet was on the PC If a wallet file, browser wallet or seed phrase was ever on this PC, assume it is known, because wallets are named targets. Create a new wallet and a new recovery phrase on a clean device and move the funds there.

Move crypto first if a wallet was on the PC

If a wallet file, browser wallet or seed phrase was ever on this PC, assume it is known, because wallets are named targets. Create a new wallet and a new recovery phrase on a clean device and move the funds there.

6 Run Microsoft Defender Offline Open Windows Security > Virus & threat protection > Scan options , choose Microsoft Defender Offline scan and select Scan now . Save your work first: Windows signs you out and restarts, and the scan takes 15 minutes. Microsoft says to suspend BitLocker beforehand or the restart may ask for the recovery key, and that results appear under Protection history . The scan does not apply to Windows on ARM.

Run Microsoft Defender Offline

Open Windows Security > Virus & threat protection > Scan options , choose Microsoft Defender Offline scan and select Scan now . Save your work first: Windows signs you out and restarts, and the scan takes 15 minutes. Microsoft says to suspend BitLocker beforehand or the restart may ask for the recovery key, and that results appear under Protection history . The scan does not apply to Windows on ARM.

7 Remove what the check found, with care If you found a program you can tie to the infection, such as a cracked installer, uninstall it in Settings > Apps > Installed apps and remove any startup entry it made. If you cannot tell, do not guess. A stealer may have been only the first of several programs, so the safe answer is the reset.

Remove what the check found, with care

If you found a program you can tie to the infection, such as a cracked installer, uninstall it in Settings > Apps > Installed apps and remove any startup entry it made. If you cannot tell, do not guess. A stealer may have been only the first of several programs, so the safe answer is the reset.

8 If you are not sure, reset Windows Open Settings > System > Recovery > Reset this PC and choose Remove everything . This wipes programs and startup entries, which does not depend on finding every piece. It cannot undo what was already taken, so the account steps above still apply. Back up documents first and restore only documents by hand, not programs.

If you are not sure, reset Windows

Open Settings > System > Recovery > Reset this PC and choose Remove everything . This wipes programs and startup entries, which does not depend on finding every piece. It cannot undo what was already taken, so the account steps above still apply. Back up documents first and restore only documents by hand, not programs.

9 Watch your money and your identity Check card and bank statements and exchange logs for several weeks and turn on alerts. If you think your personal information was stolen, the FTC says to report it at IdentityTheft.gov, which gives a personal recovery plan.

Watch your money and your identity

Check card and bank statements and exchange logs for several weeks and turn on alerts. If you think your personal information was stolen, the FTC says to report it at IdentityTheft.gov, which gives a personal recovery plan.

10 Tell the people who may be affected If your email or social accounts sent messages, tell your contacts not to open them. If it was a work PC, tell your IT or security team at once, since saved VPN and work logins may be involved.

Tell the people who may be affected

If your email or social accounts sent messages, tell your contacts not to open them. If it was a work PC, tell your IT or security team at once, since saved VPN and work logins may be involved.

How to keep Lumma Stealer and its copies off a PC

Nearly every route above needs one action from you. These habits cut most of them.

Treat any page that asks you to paste a command into Run, PowerShell or Terminal as an attack and close it. No real CAPTCHA asks for that.

Type a vendor's address yourself or use its official store listing instead of clicking the top ad.

Keep Windows and Microsoft Defender updated, and keep tamper protection and network protection on.

Use a password manager and two factor sign in, with a security key or passkey where offered, as Microsoft advises.

Use Microsoft Edge with SmartScreen or a browser that warns known bad pages.

Keep crypto seed phrases off the PC, on paper or a hardware wallet.

Do not run cracked programs, keygens or loaders from file sharing sites; Microsoft names them as a route.

Do not open attachments or links from invoice, booking or delivery emails you did not expect.

Do not let the browser save banking or wallet passwords on a PC you do not control fully.

Do not change passwords on a PC you suspect.

Do not rely on a quiet scan to say you are safe.

Questions Lumma Stealer (LummaC2)

Is Lumma Stealer a virus?

It is malware, more exactly an information stealer, and it is dangerous. It is not a virus in the old sense of a program that copies itself from file to file; it is a trojan type of program that a person or a script starts, after which it collects data and sends it to a server.

Microsoft describes it as taking data from browsers and applications, including crypto wallets, and installing other malware. Seeing the name in a news page or a log does not mean your PC is infected.

What does Lumma Stealer steal?

Microsoft names saved passwords, session cookies and autofill data from Chromium and Mozilla based browsers, crypto wallet files and wallet extensions such as MetaMask, Electrum and Exodus, VPN configuration files, email and FTP client data, Telegram data and documents such as PDF and Word files.

Microsoft's court announcement adds payment card and bank account details. Which items a copy takes depends on a settings file from its server, so not every victim loses everything.

How do I know if I have Lumma Stealer?

Often you cannot tell from the PC. The strongest sign is that you pasted a command from a fake CAPTCHA page into the Windows Run box.

Other signs are a Defender detection with LummaStealer, ClickFix or FakeCaptcha in its name, logins to your accounts from places you do not know, and crypto missing from a wallet. Check Protection history, Startup apps and Task Manager, and look at your accounts from another device. A clean result does not clear the PC.

How do I remove Lumma Stealer from Windows?

Do the accounts first, from another device:

sign out of all sessions

Then run a Microsoft Defender Offline scan in Windows Security under Virus and threat protection, Scan options. Remove any cracked installer or unknown program you can tie to the problem.

If you cannot be sure the PC is clean, use Reset this PC with Remove everything and restore only documents. We followed Microsoft pages and did not test this on an infected PC.

What is the fake CAPTCHA, or ClickFix, trick?

A web page shows an I am not a robot box and then tells you to press the Windows key and R, paste a command and press Enter. The command is placed on your clipboard by the page.

Microsoft says it is often Base64 text that starts Lumma in memory. A real CAPTCHA never asks you to run commands. If you did it, disconnect the PC, secure your accounts from another device and follow the plan on this page.

Did Microsoft shut Lumma Stealer down?

Microsoft and partners disrupted it in May 2025. A US court order let Microsoft seize, suspend or block 2,300 domains, and the Department of Justice, Europol and Japan's JC3 took part. That did not remove the program from the world.

Our radar logged new ThreatFox entries for the name on 16, 17 and 18 October 2026, though we did not read them and cannot say how active it is now. Treat it as a live threat.

I changed my passwords. Is that enough?

Not by itself. If you changed them on the infected PC, a stealer or another tool may have seen the new ones. Do it from a clean device.

Also sign out of all sessions, because a stolen session cookie can work without a password. Turn on two factor sign in, preferably a security key or passkey, check for email forwarding rules, move crypto to a new wallet and then clean or reset the PC.

Does Lumma Stealer affect Mac, iPhone or Android?

We found nothing that says so. MITRE ATT&CK lists Lumma Stealer as a Windows program, and the routes Microsoft describes use Windows tools such as the Run box, mshta and PowerShell.

On a Mac, iPhone or Android phone there is nothing to remove for this threat. If you typed a password into a suspicious page on any device, change it and turn on two factor sign in.

Will a Windows reset get rid of it, and are my accounts safe afterwards?

Reset this PC with Remove everything wipes programs and startup entries, so it does not depend on finding every piece of the infection. It does not undo the theft.

Passwords, session cookies and wallet keys that were taken stay exposed until you change them from another device, sign out all sessions and move your crypto. Restore documents by hand and install programs from their makers' own sites, never from cracks.

Will Fortect remove Lumma Stealer?

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For Lumma Stealer, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.

Microsoft Threat Intelligence: Lumma Stealer, breaking down the delivery techniques and capabilities of a prolific infostealer (21 May 2025) ( read October 23, 2026 )

Microsoft On the Issues: Microsoft Digital Crimes Unit action against Lumma Stealer (21 May 2025) ( read October 23, 2026 )

MITRE ATT&CK: Lumma Stealer, S1213 (modified 22 March 2025) ( read October 23, 2026 )

Microsoft Learn: Microsoft Defender Offline scan in Windows (updated 25 August 2026) ( read October 23, 2026 )

FTC: Email or social media hacked? Here's what to do ( read October 23, 2026 )