# FBI and CISA detail LummaC2 infostealer malware

Published: 2025-12-01 · Severity: routine · Sectors: defense, energy, financial-services, government-national, healthcare, infrastructure, telecommunications
Canonical: https://vorant.io/reports/b0fa1dc7-6bca-5bc2-96d0-931222a4076d/fbi-and-cisa-detail-lummac2-infostealer-malware

> LummaC2 infostealer malware deployed via spearphishing exfiltrates credentials, crypto wallets, and MFA details from organizations across U.S. critical infrastructure.

The FBI and CISA released a joint advisory documenting the LummaC2 information stealer malware, which first appeared for sale on Russian-language cybercriminal forums in 2022 and has been actively deployed through May 2025. Threat actors distribute LummaC2 via spearphishing emails with hyperlinks and attachments, leveraging fake CAPTCHA prompts to trick users into executing Base64-encoded PowerShell commands. The malware embeds itself in spoofed legitimate software and uses obfuscation techniques to evade endpoint detection and response (EDR) solutions and antivirus programs.

Once installed, LummaC2 exfiltrates sensitive data including personally identifiable information, financial credentials, cryptocurrency wallets, browser extensions, and multifactor authentication details. The malware operates primarily in memory without creating persistent files unless directed by its command-and-control (C2) server. It includes functionality to steal browser data (with specific modules for Mozilla and other browsers), download and execute additional payloads, capture screenshots, and delete itself on command. Private sector reporting indicated over 21,000 market listings selling LummaC2 logs across cybercriminal forums between April and June 2024, a 71.7 percent increase from the same period in 2023.

The advisory provides a comprehensive list of IOCs including over 100 domains historically associated with LummaC2 deployments, technical analysis of the malware's execution flow and C2 communication protocol, and recommended mitigations including application allowlisting, phishing-resistant MFA, network segmentation, and enhanced logging and monitoring of suspicious process behavior and API calls.

## Mentioned in this report

- Malware: LummaC2

## Detection guidance (public sample)

### Encoded PowerShell Launched Directly From Explorer (ClickFix Pattern)

ATT&CK: T1027

Detects powershell.exe or pwsh.exe spawned by explorer.exe with an encoded command, the pattern left when a user pastes a fake-CAPTCHA command into the Run dialog, as in LummaC2 delivery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Encoded PowerShell Launched Directly From Explorer (ClickFix Pattern)
description: Detects PowerShell started by explorer.exe with an encoded command argument.
  This matches fake CAPTCHA (ClickFix) lures that have the user paste a Base64 PowerShell
  command into the Run dialog, as used to deliver LummaC2. Generalises on the parent/child
  relation and the -enc flag, not on specific payloads.
tags:
- attack.execution
- attack.t1027
- attack.t1140
- attack.t1566
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \explorer.exe
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains|windash: -enc
  condition: selection
falsepositives:
- Administrators or users launching encoded PowerShell one-liners from the Run dialog
  or a shortcut for legitimate scripting
- Software shortcuts that start PowerShell with an encoded command
level: medium
id: 6519b947-30a2-5d64-9d9d-8cb341b8dd93
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b
```

### Fake CAPTCHA Verification Text in Command Line

ATT&CK: T1566.002

Detects command lines carrying fake CAPTCHA or human-verification text, which ClickFix lures append to pasted commands that deliver LummaC2. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Fake CAPTCHA Verification Text in Command Line
description: Detects process command lines that contain fake CAPTCHA or human-verification
  wording such as 'I am not a robot' or 'reCAPTCHA Verification ID'. ClickFix lures
  append this text as a comment to PowerShell or mshta commands pasted by the victim,
  as in LummaC2 delivery.
tags:
- attack.initial-access
- attack.execution
- attack.t1566.002
- attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \cmd.exe
  selection_text:
    CommandLine|contains:
    - I am not a robot
    - reCAPTCHA Verification
    - Verification ID
    - CAPTCHA Verification
    - Human Verification
  condition: selection_img and selection_text
falsepositives:
- Security awareness training or red team exercises that simulate ClickFix lures
- Administrators writing scripts that mention CAPTCHA verification in comments
level: high
id: 68534a89-45f8-5621-bf2b-4b53b585f45b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b
```

### Suspicious Script Interpreter Command Stored in RunMRU

ATT&CK: T1566.002

Detects the Run dialog history (RunMRU) recording a PowerShell or mshta command with encoded or download arguments, left by fake-CAPTCHA lures that make the user paste a command. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Script Interpreter Command Stored in RunMRU
description: Detects writes to the Explorer RunMRU registry key where the entry runs
  powershell, pwsh or mshta with encoded, URL or download-cradle arguments. This is
  the registry trace of ClickFix-style fake CAPTCHA lures that make the user paste
  a command into the Run dialog, as used to deliver LummaC2.
tags:
- attack.execution
- attack.t1566.002
- attack.t1140
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains: \Explorer\RunMRU
  selection_interpreter:
    Details|contains:
    - powershell
    - pwsh
    - mshta
  selection_args:
    Details|contains:
    - -enc
    - http
    - iex
    - downloadstring
    - frombase64string
  condition: selection_key and selection_interpreter and selection_args
falsepositives:
- Users or administrators manually running PowerShell download or encoded commands
  through the Run dialog
level: medium
id: acb88d71-6682-531a-98c7-1e5f226abbb9
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b0fa1dc7-6bca-5bc2-96d0-931222a4076d/fbi-and-cisa-detail-lummac2-infostealer-malware.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup