Fake CAPTCHA Campaigns Deliver Lumma Stealer Through PowerShell and HTA Chains

Researchers documented multiple Lumma Stealer infection chains that begin with fake CAPTCHA or verification pages and trick Windows users into launching malicious PowerShell from the Run dialog. In one case, victims reached the lure through malicious pop-up ads on a pirated-content site; in another, a page at you-checked.com copied a hidden command to the clipboard that fetched follow-on payloads from domains including ferrydero.com and fill-tomap.com. The malware family, also known as LummaC2, is a malware-as-a-service infostealer designed to steal browser data, credentials, cryptocurrency wallets, session tokens, and other sensitive information.

The observed chains used mshta.exe, obfuscated HTA and JavaScript, layered PowerShell stages, and multiple packed .NET components to retrieve and execute the final payload while evading analysis. Analysts reported AES and XOR decryption, SmartAssembly and .NET Reactor packing, AMSI bypass attempts, anti-sandbox and anti-debugging checks, Windows Defender evasion, and cleanup steps such as deleting downloaded archives after execution. One intrusion created files under C:\ProgramData, contacted iplogger.co, and launched an infostealer executable named jegule.exe, while another sample ultimately communicated through winhttp.dll and ws2_32.dll; investigators also recovered additional URLs from a Steam Community profile using ROT15 decoding.