Loading story…
Researchers documented multiple Lumma Stealer infection chains that begin with fake CAPTCHA or verification pages and trick Windows users into launching malicious PowerShell from the Run dialog. In one case, victims reached the lure through malicious pop-up ads on a pirated-content site; in another, a page at you-checked.com copied a hidden command to the clipboard that fetched follow-on payloads from domains including ferrydero.com and fill-tomap.com. The malware family, also known as LummaC2, is a malware-as-a-service infostealer designed to steal browser data, credentials, cryptocurrency wallets, session tokens, and other sensitive information.
The observed chains used mshta.exe, obfuscated HTA and JavaScript, layered PowerShell stages, and multiple packed .NET components to retrieve and execute the final payload while evading analysis. Analysts reported AES and XOR decryption, SmartAssembly and .NET Reactor packing, AMSI bypass attempts, anti-sandbox and anti-debugging checks, Windows Defender evasion, and cleanup steps such as deleting downloaded archives after execution. One intrusion created files under C:\ProgramData, contacted iplogger.co, and launched an infostealer executable named jegule.exe, while another sample ultimately communicated through winhttp.dll and ws2_32.dll; investigators also recovered additional URLs from a Steam Community profile using ROT15 decoding.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Blackpoint Cyber documented a previously unknown Windows malware framework named Avalon that used a legal-document phishing lure, Proton Drive-hosted archive, ISO/LNK execution chain, and MSBuild-based stages before deploying a ransomware component called CrownX. The report detailed credential theft, lateral movement, ETW/AMSI interference, recovery sabotage, and file encryption with the .8hn2yc extension.
A separate analysis reported a Lumma Stealer campaign using a fake verification page at you-checked.com to copy a hidden PowerShell command, which fetched additional code and a ZIP payload from attacker-controlled domains. The write-up also described file creation under C:\ProgramData, contact with iplogger.co, execution of an infostealer named jegule.exe, and a second obfuscated mshta/HTA-based sample.
A forensic write-up detailed a multi-stage Lumma Stealer infection chain that began with a fake CAPTCHA page and led victims to execute a malicious PowerShell command via the Windows Run dialog. The analysis described subsequent HTA, PowerShell, .NET loader, AMSI bypass, and evasion stages culminating in Lumma Stealer execution.
A malware analysis detailed a Lumma Stealer infection chain in which a fake CAPTCHA page tricked users into running a clipboard-copied PowerShell command that fetched additional payloads and launched a masqueraded executable. The report also documented persistence behavior, suspicious network destinations, and multiple indicators of compromise including hashes, an IP address, and a DigitalOcean Spaces URL.
A 2024-09-09 analysis examined the second stage of a Lumma Stealer infection chain triggered by a fake CAPTCHA page, detailing an mshta-delivered loader that used layered JavaScript and PowerShell obfuscation plus AES-decrypted content to fetch additional payloads. The report linked the final injected payload in the legitimate BitLockerToGo process to Lumma Stealer and published IOCs including b-cdn URLs, .shop C2 domains, and SHA-256 hashes.
A late-August 2024 analysis documented a Lumma Stealer campaign using fake human-verification and CAPTCHA pages to trick users into executing a malicious PowerShell chain. The report described clipboard injection, mshta.exe abuse, payload delivery URLs, ZIP archives containing legitimate tools with malicious DLLs, and command-and-control domains used for exfiltration.
A public analysis described how Dolphin Loader abused the ITarian remote monitoring and management tool as part of its activity. The reference indicates the abuse pattern was documented and published by the researcher.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
trojan-killer.net
Open sourceaviab1.github.io
Open sourcemedium.com
Open sourcev4ensics.gr
Open sourcemandarnaik016.in
Open sourcedenwp.com
Open sourcedenwp.com
Open sourcerussianpanda95.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors distributed **LummaStealer** through two social-engineering chains that targeted users seeking pirated software or attempting to pass fake verification prompts. One campaign, active since at least December 2024, used GitHub repositories, cracked-software forums, URL shorteners, and posts on platforms including Facebook, Devpost, TikTok, and Chromium issues to push victims toward malicious JavaScript. That script suppressed referrer leakage, captured page-title context, and redirected users through intermediary domains on `.cfd`, `.click`, `.info`, and `.xyz` before serving password-protected archives from **MEGA** that extracted a LummaStealer executable. A separate delivery chain used counterfeit **CAPTCHA** pages to trick users into opening the Windows Run dialog and pasting a PowerShell command that fetched follow-on instructions from a shortened URL, downloaded a ZIP archive from `vultrcdn[.]com`, and launched a disguised `Setup.exe`. The infection sequence relied on legitimate-looking or signed binaries such as a revoked `Mergecap.exe`, a renamed `BtDaemon.exe` as `StrCmp.exe`, `more.com`, and `searchindexer.exe`, indicating DLL sideloading and process injection for evasion. Investigators observed outbound traffic to suspicious domains including `accentypastedw[.]store` and `onefreex.com`, while analysis of the final payload showed infostealer behavior including scheduled task creation, cryptographic API use, timestamp tampering, and file-permission changes.
Jun 29, 2026
Multiple incidents have been documented involving the deployment of the Lumma Stealer malware on Windows systems, followed by the installation of additional malicious payloads. Technical analysis reveals that the Lumma Stealer installer, a large PE32 executable, temporarily saves several files to the infected host, including AutoIt3 scripts and various data files. The infection process also generates a custom `.a3x` AutoIt3 script and establishes command-and-control (C2) communications with domains such as `offenms[.]cyou`. Network traffic captures and file samples from these incidents have been made available for further analysis, providing insight into the infection chain and the nature of the follow-up malware. Indicators of compromise (IOCs), packet capture files, and extracted malware samples have been published to assist defenders in identifying and mitigating these threats. The technical details include SHA256 hashes of the malware, file paths used during infection, and specifics about the C2 infrastructure. These resources enable security teams to detect similar infections and understand the tactics used by threat actors leveraging Lumma Stealer in multi-stage attacks.
Jun 29, 2026
Security researchers reported a sharp rise in **"paste-and-run"** phishing, a social-engineering technique that tricks users into executing attacker-supplied commands by pasting them into Windows tools such as the Run dialog or PowerShell. In these attacks, a lure page covertly places an obfuscated command on the victim's clipboard and presents steps framed as a verification or troubleshooting task, often through a fake CAPTCHA. Red Canary said the method expanded significantly in 2025 and became the second most common initial access vector it observed after traditional phishing, delivering payloads including information stealers, remote management tools, loaders, and cryptominers. One documented campaign targeted GitHub users with spoofed security alerts claiming critical flaws in their repositories. Victims were sent to `github-scanner[.]com`, where a fake CAPTCHA instructed them to press Windows+R, Ctrl+V, and Enter, causing PowerShell to run clipboard-pasted malicious code that downloaded `l6e.exe`; VirusTotal analysis identified the payload as **Lumma Stealer**, a credential-theft malware. Researchers also warned that variants such as **FileFix** abuse the Windows File Explorer address bar to run commands, and similar lures have appeared on macOS through fake sites impersonating trusted tools such as Homebrew to distribute **Odyssey** and **Atomic Stealer**.
Jun 29, 2026