INTEL-6: The Malware That Does Math to Prove You're Human

Posted on March 25, 2026 • 3 min read • 507 words
Malware   Sandbox Evasion   LummaC2   MITRE ATT&CK   Picus   Threat Detection   SOC  
Malware   Sandbox Evasion   LummaC2   MITRE ATT&CK   Picus   Threat Detection   SOC  
Share via
LummaC2 malware calculates the Euclidean distance and angles of mouse cursor paths using trigonometry to detect sandboxes. Sandbox evasion surged into the top 5 most prevalent techniques for the first time.
The INTEL   Why It Matters   What To Do   MITRE ATT&CK   Learn More  

The INTEL  

Malware has developed survival instincts. It now studies its environment before acting — and if it detects it’s being watched, it plays dead.

LummaC2 (also known as Lumma Stealer) is a Malware-as-a-Service infostealer that has been actively operated since 2022 and remains one of the most widespread threats in 2026 — despite multiple law enforcement takedowns. Once it activates, it harvests browser-stored passwords, session cookies that bypass MFA, OAuth tokens, cryptocurrency wallets, clipboard contents, and system metadata. It enables follow-on attacks including ransomware, business email compromise, and full account takeover.

What makes the 2026 variant remarkable isn’t what it steals. It’s how it decides whether to steal at all.

LummaC2 now calculates the Euclidean distance and angles of mouse cursor paths using trigonometry. A human moves a mouse in curves — small accelerations, natural arcs, minor corrections. An automated sandbox moves in straight lines. LummaC2 measures the difference. If the geometry says “machine,” the malware refuses to execute. No detonation. No C2 connection. No credential theft. Nothing.

Your sandbox passes the file as clean. Your SOC closes the ticket. The file moves to production. On a real machine, with a real user moving a real mouse — it activates fully. Passwords, cookies, tokens, wallets — harvested silently.

The file that executed and did nothing isn’t safe. It’s waiting for a human.

Why It Matters  

Sandbox evasion surged into the top 5 most prevalent attack techniques for the first time in the Picus Red Report 2026, based on analysis of 1.1 million malicious files. This isn’t malware checking for VM artifacts or file system indicators — those are old tricks that sandbox vendors have already solved. This is malware that analyzes human behavior patterns using mathematics and makes a binary decision: real environment or analysis environment.

The implication is that any organization relying on automated sandbox verdicts as a primary gate for file safety may be systematically passing self-aware threats through to production. A “clean” sandbox result no longer means the file is safe. It may mean the file is sophisticated enough to know it was being tested.

What To Do  

Treat “nothing happened” as a finding, not a clearance. When a suspicious file executes in your sandbox and exhibits zero malicious behavior, escalate — don’t close. Investigate processes that query system uptime, check mouse movement patterns, calculate time intervals, or sleep before executing. These are indicators of environment-aware evasion, not benign software. If your sandbox consistently reports “clean” on files from untrusted sources, the sandbox may be the one being tested, not the file.

MITRE ATT&CK  

  • T1497 — Virtualization/Sandbox Evasion: LummaC2 trigonometric mouse analysis; environment-aware execution decisions
  • T1497.001 — System Checks: Querying uptime, user interaction patterns, and hardware profiles to detect analysis environments

Learn More  

Powered by FIR Risk Platform — AI-driven threat intelligence for enterprise risk leaders.

On this page: