Lumma Stealer
The stealer behind the fake “verify you are human” pages. What it takes from an infected computer, how it gets there, and how to check whether your logins ended up in its logs.
- Also called
- LummaC2
- Seen since
- 2022
- Runs on
- Windows
- Sold as
- Tiered subscriptions on forums and Telegram
What Lumma Stealer takes
- Passwords, cookies and autofill entries from Chrome, Edge, Firefox and other browsers
- Cryptocurrency wallets and browser wallet extensions
- Data from two-factor authentication browser extensions
- Documents and other files matching what the buyer asked for
How it spreads
- Fake CAPTCHA pages that tell the visitor to paste a command into Windows
- Cracked software and fake installers
- Malicious ads and fake browser updates
Background
Lumma grew quickly from 2023 onward and became one of the most common stealers in circulation.
In May 2025 Microsoft, the US Department of Justice, Europol and Japanese authorities took down a large part of the infrastructure Lumma’s customers used. Takedowns cut off new collection, but logs that were already stolen stay in circulation.
Checking for your logins
Search your email address, username or company domain on this site. The check covers stealer logs from every family, Lumma Stealer included, and shows how many of your logins are in them, for which sites and where the devices were.
A stealer log doesn’t record which malware made it, so a result won’t say whether it was Lumma Stealer or another stealer. The steps afterwards are the same either way: clean the device, then change passwords from a safe one.
Other infostealers
- RedLine Stealer: For years the most common source of stealer logs on the market.
- Vidar: A long-running stealer, often delivered together with other malware.
- Raccoon Stealer: A low-cost stealer whose alleged operator was arrested in 2022.
- StealC: A newer stealer that borrows from Vidar, Raccoon and RedLine.
- Atomic macOS Stealer: Proof that Macs get infostealers too.
The full records are on Seer
This site shows how many stealer log records hold a login and a masked sample of them. Seer, which runs the check, shows every record in full: the saved logins and passwords, the cookies, the infected device and when the log was collected.
Seer also searches breach records and social accounts, so one email address shows everywhere it has leaked and every account it is linked to.
- Stealer log searchFull records from infected devices, by email, username, domain, password or IP address.
- Breached credentialsWhich data breaches an email address or username appears in, and what leaked with it.
- Social account searchThe accounts an email address, username or phone number is linked to across hundreds of sites.
- Plans and pricingA free account to start, and plans for investigators and security teams.