Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Microsoft telemetry showed more than 394,000 PCs affected by Lumma Stealer between March 16 and May 16, 2025. That is a count for a two-month observation window—not evidence that 394,000 computers remain infected today. The finding matters because Lumma can steal credentials and browser session tokens that may let attackers access accounts or pursue a wider organizational intrusion.
What Microsoft’s 394,000 figure means
HotHardware reported on May 22, 2025, that Microsoft identified more than 394,000 affected PCs during the period from March 16 through May 16, 2025. The figure describes devices observed in that historical window; it is not a current infection total. Microsoft’s Digital Defense Report 2025 provides the underlying country-level Windows device telemetry.
What Lumma Stealer can take
Lumma, also known as LummaC2 or LummaC, is an infostealer: malware built to collect valuable data from infected devices. Microsoft says infostealers can harvest credentials, browser session tokens, and system-context data at scale. A stolen password or session token can expose an account; access obtained from one device can also be sold or used by access brokers and ransomware operators to pursue a broader intrusion.
Microsoft described Lumma as the most prevalent infostealer it observed in the year covered by its 2025 report. It accounted for 51% of the top five infostealers listed in Microsoft Defender Threat Expert notifications. That percentage refers to that notification-based ranking, not to all malware infections or all PCs.
#1 Best Overall
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Where Microsoft observed affected devices
Microsoft Threat Intelligence reported these country counts for Windows devices affected between March 16 and May 16, 2025:
| Country | Affected Windows devices |
|---|---|
| India | 44,197 |
| Russia | 40,868 |
| Brazil | 21,137 |
| United States | 15,647 |
These are reported country-level counts for the specified period, not a ranking of current infections or a complete breakdown of every affected country.
Rank #2
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
How Lumma infections reach people
Microsoft says infostealers are commonly delivered through malvertising, search-engine optimization poisoning, cracked software, and deceptive techniques such as ClickFix. Fake software downloads and update pages can persuade someone to run malware while believing they are installing a legitimate program or fixing a computer problem.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What users can do to reduce risk
- Keep current anti-malware protection enabled and allow it to receive updates.
- Be cautious with unexpected links and attachments, and avoid downloads from unfamiliar sites, cracked-software sources, and pages imitating popular apps or updates.
- Use phishing-resistant multifactor authentication where available. A FIDO2 security key is one possible implementation; it can help protect account access but does not remove malware from a device.
- Avoid saving passwords on shared or unmanaged computers, where other users or malicious software may be able to access them.
What organizations should monitor
Microsoft’s guidance focuses on detection and limiting the damage if credentials are stolen. It recommends investigating suspicious loader activity, blocking clipboard-to-shell behavior, and watching for downloads that imitate popular software. Organizations should also reduce password storage on unmanaged or shared endpoints and educate users about deceptive downloads, fake update pages, and cracked tools.
Rank #3
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Security teams should treat a detected infostealer as a possible starting point for further compromise, not merely as an isolated malware event. Microsoft’s report says defenders must treat infostealer infections as precursors to wider compromise. Controls should therefore connect endpoint detection with identity protections, including phishing-resistant MFA, and the ability to investigate and contain suspicious download or script activity. The report identifies these control areas but does not compare security vendors.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If you suspect a PC is infected
The prevention and detection recommendations above are not a Lumma-specific removal procedure. If you suspect an active infection, avoid using the affected device for sensitive logins and contact your organization’s IT or security team if it is a work computer. For a personal PC, use a trusted security provider’s current incident-response or malware-removal guidance rather than assuming that changing a password alone has cleaned the device.
Quick Recap
Best Value
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Rank #4
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
Sources
- HotHardware, May 22, 2025, for the reported headline figure and observation dates.
- Microsoft Digital Defense Report 2025, for Lumma context, country-level telemetry, and defensive recommendations.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
