How to get rid of Lumma Stealer
Got infected with Lumma Stealer? You’re in the right place. This malware is a relatively new piece of malware that has seen a big rise in infections over the past few months. With a robust infrastructure and no obvious symptoms, the Lumma Stealer works silently in the background, stealing everything from cryptocurrency to private messages from infected devices.
If you ran an information stealer on your computer, changing all your passwords may not completely remove the malware. Follow our instructions to completely wipe this malware from your device.
What is Lumma Stealer?
Lumma Stealer is an infostealer malware, meaning it's designed to steal information from devices and transmit it to the cybercriminal who launched it. Due to its design, it can also install more malware on your device, and, for example, take over your processing power for cryptomining.
Unlike infostealers from the past, Lumma Stealer operators do not focus on a single delivery method, instead, they find multiple ways to infect devices. These include traditional phishing emails, advertising, JavaScript forced downloads, embedding within pirated applications, or even abusing CAPTCHA through the ClickFix technique.
| Name | Lumma Stealer (LummaC2) |
| Type | Information stealer, malware-as-a-service (MaaS) |
| Device | Primarily Windows computers, some reports suggest it may potentially affect macOS systems as well. |
| Symptoms | Often operates stealthily, with no noticeable symptoms on the device; potential symptoms include: unauthorized access to online accounts, suspicious banking transactions, increased network activity, and decreased device performance. |
| Damage | Theft of sensitive data (login credentials, credit card information, cryptocurrency wallet information, personal data), financial loss, identity theft, increased risk of future malware attacks. |
How to tell if my device is infected with Lumma Stealer?
Realizing that you’re infected with Lumma Stealer is perhaps one of the hardest parts of fighting the virus. Lumma Stealer operates stealthily and won’t cause any disruptions on your device unless it is used to install a different piece of malware.
The biggest hint that something is amiss will probably be unauthorized access to your banking, email, social, or online gaming accounts. Once that happens, you should immediately contact all payment providers to temporarily lock your accounts and cards.
Also, try to remember whether you clicked any suspicious links or recently downloaded any software. A particularly popular method is abusing CAPTCHA challenges, asking people to enter a command-line prompt to verify their identity. If you’ve been prompted to use the Windows+R key by an internet popup and followed through the instructions, you’re likely infected with Lumma Stealer.
How to remove Lumma Stealer
Removing Lumma Stealer is pretty much impossible without using dedicated antivirus software like TotalAV. Since the software embeds itself deep in your system, finding it manually is not a viable option. Here’s what you should do in order to remove the Lumma Stealer.
- Avoid logging into accounts until you are certain the malware is removed
- Disconnect from the internet
- Backup important files if possible and safe to do so
Remove the malware
- Restart your computer and boot into safe mode with networking
- Install a reputable antivirus software like TotalAV
-
Run a full system scan and delete the detected malware files
- Check your browser settings and extensions for any unrecognized changes, and make sure to enable full browser security
- Check the hosts file (located at C:\Windows\System32\drivers\etc\hosts) for any unrecognized domains and IP addresses
Clean up your accounts
- Restart your computer and boot normally
- Change all your passwords
- Update your operating system, browsers, security software, and other applications
- Monitor your personal accounts and system for any suspicious activity
If you follow these steps, you should be able to delete Lumma Stealer and return to normal functioning. Remember to repeat these steps for all your devices to ensure that the malware won’t return via your network.
How to prevent future Lumma Stealer infections
Now that you’ve dealt with a Lumma Stealer infection, you should ensure it doesn’t infect your devices again. That’s why you should:
- Avoid clicking suspicious links. Most Lumma Stealer infections start with a phishing link. These can appear in emails, social media messages, or in ads. Always check whether the link you’re clicking comes from a reputable website.
- Don’t download files from unknown sources. Lumma Stealer is often hidden in files like pirated games, TV shows, or ebooks. If you’re downloading files from such sources, proceed with extreme caution.
- Use antivirus software. Antivirus software like TotalAV will ensure that you have real-time protection enabled, and, should you run into Lumma Stealer, it will protect you from accidentally installing it.
- Do not paste commands into the command line or run window. Lumma Stealer websites often prompt you to run something in your run window or command line to “confirm your identity.” This isn’t needed. Do not paste commands from unknown websites into the command line, as these attacks can be hard to detect even for the best antivirus software.
- Enable two-factor authentication (2FA). In case you become infected, 2FA will help you avoid losing access to important accounts, like your online banking, or email.
Conclusion
Lumma Stealer is a dangerous piece of software that can really impact your life. By stealing some of your most important information, it can rob your accounts, take out loans in your name, and use your data in countless other nefarious ways.
That’s why you should do everything possible to protect yourself against this virus. Your first line of defence is to use caution when surfing the internet. However, reliable antivirus software like TotalAV will help you protect yourself from malware, including Lumma Stealer, that you may be exposed to despite your best intentions.
FAQ
Is changing my passwords and enabling 2FA enough? Am I safe now?
No, changing your passwords and enabling 2FA is not enough. You have to use antivirus software like TotalAV to remove Lumma Stealer. Only then should you change your passwords.
How can I delete Lumma Stealer?
To delete Lumma Stealer, use an antivirus like TotalAV or Bitdefender. Only a system scan will help you completely delete the malware.
What anti-malware software is effective against Lumma Stealer?
Any reputable anti-malware software should be effective against Lumma Stealer. If you need any help deciding, read our article on the best anti-malware software.
