LummaStealer Spread Through Cracked Software Lures and Fake CAPTCHA Pages

Threat actors distributed LummaStealer through two social-engineering chains that targeted users seeking pirated software or attempting to pass fake verification prompts. One campaign, active since at least December 2024, used GitHub repositories, cracked-software forums, URL shorteners, and posts on platforms including Facebook, Devpost, TikTok, and Chromium issues to push victims toward malicious JavaScript. That script suppressed referrer leakage, captured page-title context, and redirected users through intermediary domains on .cfd, .click, .info, and .xyz before serving password-protected archives from MEGA that extracted a LummaStealer executable.

A separate delivery chain used counterfeit CAPTCHA pages to trick users into opening the Windows Run dialog and pasting a PowerShell command that fetched follow-on instructions from a shortened URL, downloaded a ZIP archive from vultrcdn[.]com, and launched a disguised Setup.exe. The infection sequence relied on legitimate-looking or signed binaries such as a revoked Mergecap.exe, a renamed BtDaemon.exe as StrCmp.exe, more.com, and searchindexer.exe, indicating DLL sideloading and process injection for evasion. Investigators observed outbound traffic to suspicious domains including accentypastedw[.]store and onefreex.com, while analysis of the final payload showed infostealer behavior including scheduled task creation, cryptographic API use, timestamp tampering, and file-permission changes.