Fake CAPTCHA and Pirated Software Campaigns Drive Lumma and Vidar Infostealer Activity

Security researchers reported sustained infostealer activity centered on Lumma Stealer and Vidar, with operators distributing malware through fake CAPTCHA lures, pirated software downloads, phishing emails, and poisoned search results. AhnLab said July 2026 campaigns commonly delivered Remus, LummaC2, ACRStealer, and Vidar via cracked software hosted on services including mega.nz, Amazon S3, and MediaFire, while Microsoft and other well-known brands were frequently impersonated. TrendAI separately described fake verification pages that trick victims into pasting malicious commands into the Windows Run dialog, leading to multistage infections that deployed Lumma Stealer, Rhadamanthys, AsyncRAT, XWorm, and Emmenhtal.

The campaigns relied on evasive execution chains using mshta.exe, obfuscated PowerShell, DLL sideloading, temporary Chromium profiles, and even MP3 files carrying injected JavaScript to load payloads in memory and communicate with attacker-controlled infrastructure. Researchers also said Vidar Stealer 2.0 expanded its appeal with a rewritten codebase, multithreaded theft, stronger anti-analysis, and broader credential and wallet theft, helping it gain momentum as some criminals moved away from Lumma after a doxxing incident and Telegram account compromise disrupted Lumma operations and eroded trust in its malware-as-a-service ecosystem. The reporting indicates that infostealer operators are rapidly shifting delivery methods and malware families while continuing to target both enterprises and individual users for credential theft and follow-on attacks.