Skip to main content

Cybersecurity report

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

LastPass, June 2, 2025. That Lumma grew in popularity and took over part of RedLine's market share after Operation Magnus on 28 October 2024, with RedLine having accounted for 9.9 million hosts or 43% of infostealer infections observed by Flashpoint in 2024..

Source type
Cybersecurity report
Published
June 2, 2025
Research grade
T2
Used in entries
1

Bibliographic record

Publisher
LastPass
Published
June 2, 2025
Source type
Cybersecurity report
Research grade
Source grade T2
Language
English
Official record
Not an official publication
Address
https://blog.lastpass.com/posts/dark-side-of-the-lumma
What it supports
That Lumma grew in popularity and took over part of RedLine's market share after Operation Magnus on 28 October 2024, with RedLine having accounted for 9.9 million hosts or 43% of infostealer infections observed by Flashpoint in 2024.
Dataset id
src_lastpass_lumma_2025

Research notes

  • By Stephanie Schneider. The post's date line reads 'June 02, 2025'; the host returns an Akamai 'Access Denied' page to plain curl, so the date is taken from the rendered page read on 2026-08-23.
  • Infection-share figures are Flashpoint's, cited by LastPass, not LastPass telemetry.
  • LastPass is a vendor commentator here, not a participant in Operation Magnus - T2 rather than T1.

How this source is used

Cited 1 time across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

Cited by

Later activity

1 citation

Cited for activity recorded after the takedown.

All sources