Lumma Stealer, one of the most dangerous information-stealing malware families, has been successfully disrupted by Microsoft and law enforcement agencies around the world. Microsoft's Digital Crimes Unit (DCU) has just announced an international operation to disable Lumma Stealer, a variant of info-stealing malware widely used by criminal groups and threat actors worldwide.
Between March 16 and May 16, 2025, Microsoft identified more than 394,000 Windows computers infected with Lumma. After receiving an order from the US District Court for the Northern District of Georgia, Microsoft seized 2,300 domains that formed the backbone of Lumma's infrastructure. The US Department of Justice also seized Lumma's central command structure and disrupted the online marketplaces that sold Lumma.
According to a Microsoft spokesperson, Lumma is easy to distribute, hard to detect, and can be programmed to bypass certain security defenses, making it a top tool for cybercriminals and online threat actors. Criminals have used it as an effective way to gain initial access to accounts or sensitive information, paving the way for other types of cybercrime such as ransomware and fraud.
How Lumma Stealer Works and What It Can Do
Lumma Stealer, also known as LummaC2, is a Malware-as-a-Service (MaaS) offering that can steal data from a wide range of browsers. In recent years, cybercriminals have used Lumma to steal passwords, credit cards, bank account information, and cryptocurrency wallets in large-scale attack campaigns.
LummaC2 is a Malware-as-a-Service Infostealer that has been active since late 2022 and has grown increasingly popular among cybercriminals. The malware can harvest login credentials and cookies from browsers, locate locally stored cryptocurrency wallets and extensions, and target VPNs along with various other internet applications.
Lumma also collects a range of documents (PDF, DOCX, RTF) from local user profiles and steals metadata about infected machines for further exploitation. The malware spreads through several channels, including phishing emails, malicious ads, downloads from compromised websites, and fake Captcha challenges.
The International Operation to Take Down Lumma Stealer
Europol and Microsoft worked together to disrupt the world's largest Infostealer, Lumma. The joint operation targeted the sophisticated ecosystem that lets criminals exploit stolen information at scale. Microsoft worked with the federal court in Georgia, the US Department of Justice, Europol, and the Japan Cybercrime Control Center to dismantle Lumma's infrastructure.
The seized domains are now redirected to sinkholes controlled by Microsoft, which both protects users and gives analysts new insight into malicious activity. With its infrastructure disrupted, the Lumma business has effectively been shut down.
Microsoft identified the main developer behind Lumma as a Russian hacker known by the alias "Shamel". In a recent interview with a network security researcher, the hacker claimed to have about 400 active customers. That may no longer be true, because Windows Defender and Microsoft's other endpoint security tools can now reliably detect this all but disabled malware.
Summary: The international operation led by Microsoft successfully disrupted Lumma Stealer, one of the most dangerous information-stealing malware families today. By disabling more than 2,300 malicious domains and seizing its central command structure, Microsoft and its partners protected more than 394,000 Windows computers from having their passwords, credit card details, and cryptocurrency wallets stolen. Disrupting tools that cybercriminals rely on regularly can have a significant and lasting impact on them, because rebuilding malicious infrastructure and finding new exploitation tools costs time and money. Users should keep their security software up to date and use reputable antivirus solutions to protect personal and business information from similar threats in the future.
