Lumma Stealer
Software · ATTACK:enterprise:S1213
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1213",
"title": "Lumma Stealer",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1213",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--674c514f-e485-47a8-9d49-1aaa70de155b",
"external_id": "S1213",
"domain": "enterprise",
"created": "2025-03-22T15:05:50.305Z",
"modified": "2025-03-22T16:02:03.819Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "LummaStealer"
},
{
"source_name": "TrendMicro LummaStealer 2025",
"url": "https://www.trendmicro.com/en_us/research/25/a/lumma-stealers-github-based-delivery-via-mdr.html"
},
{
"source_name": "Fortinet LummaStealer 2024",
"url": "https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube"
},
{
"source_name": "Cybereason LumaStealer Undated",
"url": "https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"
},
{
"source_name": "Netskope LummaStealer 2025",
"url": "https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection"
},
{
"source_name": "Qualys LummaStealer 2024",
"url": "https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha"
}
]
}Explicit source assertions (35)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02c214f7-2c16-462f-9cc0-169c794f4e06
Fortinet LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1059.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02eeb90c-c76a-4009-8319-d8d286efa06c
Cybereason LumaStealer Undated · Qualys LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1195
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--082eb8f7-d6e6-48c4-8fb9-7a4b02003ea4
TrendMicro LummaStealer 2025 · Fortinet LummaStealer 2024 · Cybereason LumaStealer UndatedATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e86ff72-2edc-4924-9f05-7e559b54ac82
Cybereason LumaStealer UndatedATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21f211bb-733d-4fed-b8c5-e008811097db
TrendMicro LummaStealer 2025 · Fortinet LummaStealer 2024 · Cybereason LumaStealer UndatedATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35a86a34-1ea3-4f78-bd73-96b9975f9927
Qualys LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39742f2e-0cba-4315-b2c5-fd8d8e604413
Netskope LummaStealer 2025ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e7ca7c1-39f9-4549-8446-0610f8c0c1ea
Qualys LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1218.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d6143a5-73dc-4e72-8677-6b26dbfaa114
TrendMicro LummaStealer 2025ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a8ea0ac-7a51-4440-898b-a70ee71d06a4
TrendMicro LummaStealer 2025 · Fortinet LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a9ef207-3a5b-47c0-9ffb-938966295700
Netskope LummaStealer 2025 · Qualys LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5fd27d34-7250-4c1d-81ce-683cdb527b9c
Cybereason LumaStealer UndatedATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74474695-0959-42a8-8352-e70486d066f4
Netskope LummaStealer 2025ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--827bdd59-c6b9-43fe-9004-ab9a740e323a
Cybereason LumaStealer Undated · Netskope LummaStealer 2025ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1176.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b05c779-8401-4c2f-a652-dc1ff91f34cd
Cybereason LumaStealer UndatedATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c9728bd-f58c-4a78-8b4d-63e8fe8cce31
TrendMicro LummaStealer 2025ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9726fa12-6427-4e71-8acb-c3438e7ad5b0
Fortinet LummaStealer 2024 · Qualys LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1204
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b3e3de5-c598-446c-981d-5dc1ca8ab5a9
Cybereason LumaStealer Undated · Netskope LummaStealer 2025 · Qualys LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1036.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8840f03-6877-48ac-992c-d8ef6779675f
Netskope LummaStealer 2025ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa2d7045-fbad-4b5c-a24e-fd904e089875
Fortinet LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab7ec393-b1b1-4772-80d6-fd1d895ea39a
Fortinet LummaStealer 2024 · Cybereason LumaStealer Undated · Netskope LummaStealer 2025 · Qualys LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd88fffc-e2ca-4800-92cd-8061537fce16
Cybereason LumaStealer UndatedATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bda15177-2409-49d9-9233-4d52fec364c0
Fortinet LummaStealer 2024 · Netskope LummaStealer 2025ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c021ed6c-a241-4c20-ad6c-3d267baeac40
Cybereason LumaStealer UndatedATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5dbf061-d021-436b-b6e7-6bb6156584cc
Qualys LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2ab4ecc-b4e2-414f-8cd5-db890f71f398
TrendMicro LummaStealer 2025ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1217
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d86d22e4-87ca-4039-8a36-2708f68704e6
Cybereason LumaStealer UndatedATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1539
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db995d8c-b561-4fdc-9c5b-a19b2383c058
TrendMicro LummaStealer 2025 · Fortinet LummaStealer 2024 · Cybereason LumaStealer UndatedATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd277c25-be30-421c-8201-1747522951ec
Fortinet LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e571239e-b3d9-49b1-a418-77455d7a5312
Fortinet LummaStealer 2024 · Qualys LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eab39c6d-8ebc-4961-9c16-e7bb00bacc43
Cybereason LumaStealer UndatedATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed7ce0cf-8044-4af8-8acf-db94abb79766
Cybereason LumaStealer UndatedATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eeeb81ca-b5df-4477-918b-a70b8097da28
Fortinet LummaStealer 2024ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9957b8a-0ece-4d97-8a56-8ca320e1828d
Cybereason LumaStealer UndatedATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe865909-091d-42cd-82a1-5cfc5df38e4d
TrendMicro LummaStealer 2025 · Fortinet LummaStealer 2024 · Cybereason LumaStealer Undated