Lumma Stealer 2026: Persistent Infostealer Escalates C2 Traffic Through Scheduled Tasks
In January 2026, an ongoing wave of Lumma Stealer infections demonstrated a distinctive post-infection pattern on Windows hosts. After initial data exfiltration, compromised machines retrieved a malicious PowerShell payload from Pastebin, which led to repeated execution of mshta commands against a .cc command and control (C2) domain—fileless-market[.]cc. The malware automatically created dozens of scheduled tasks, each triggering outbound HTTPS connections to the C2 infrastructure over many hours, elevating the risk of persistent infiltration and extended data leakage. This approach resulted in a marked increase in C2 traffic and operational risk for affected organizations. This case is relevant now as it highlights a trend of increasingly persistent infostealer operations leveraging fileless persistence, public paste sites, and escalated task creation for resilience. Security teams must be alert to novel automation and scripting techniques that facilitate stealthy C2 traffic and recurring infections, especially as infostealers like Lumma gain popularity in the cybercriminal ecosystem.
Kill Chain
