The Patching Friars' AlmanacA calendar of CVE saints
Lumma StealerHoly card for d-lumma, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 Non sonoun robotWin+R Ctrl+V Lumma Stealer NON SUM ROBOTUM
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Circle VI · Banking trojans and infostealers

The Demon Lumma, the Fake CAPTCHA

Legend

Sold as a service since 2022, Lumma steals credentials, cookies and crypto wallets, often by convincing victims with a fake CAPTCHA to paste a command into their own system: the trick known as ClickFix. On 21 May 2025 Microsoft's Digital Crimes Unit, the US Department of Justice, Europol's EC3 and Japan's JC3 struck it together, seizing around 2,300 domains and its control panel. Researchers later reported a partial rebuilding of its infrastructure.

Exorcism

Cast it out by teaching that no real CAPTCHA ever asks you to paste a command into Run or a terminal. Use a password manager and phishing-resistant MFA, and after an infection revoke sessions and rotate every credential.

Technical record

Also known as
LummaC2, LummaC
Circle
Circle VI · Banking trojans and infostealers
First seen
2022
Status
Exorcised (Lumma disruption, 2025-05-21)

An infostealer sold as malware-as-a-service since 2022 that steals browser credentials, cookies and crypto wallets, often delivered through fake CAPTCHA 'ClickFix' lures. Microsoft, the DOJ, Europol and Japan's JC3 disrupted it on 21 May 2025, seizing around 2,300 domains and its control panel. Researchers reported partial rebuilding of its infrastructure afterwards.

Sources: attack.mitre.org · blogs.microsoft.com · MITRE ATT&CK reference S1213

© The MITRE Corporation. ATT&CK® information is reproduced and distributed with the permission of The MITRE Corporation.

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.