Fake CAPTCHA Campaigns Use Mshta and PowerShell to Deliver Lumma Stealer

Fake CAPTCHA campaigns are tricking users into executing commands that deliver Lumma Stealer through legitimate Windows utilities. Hexastrike traced the activity from fraudulent GitHub vulnerability notifications to a customer incident in which CrowdStrike detected suspicious mshta.exe and PowerShell activity, blocked an encrypted payload, and responders isolated the affected host. Investigators identified a fake CAPTCHA page hosted on Oracle Cloud infrastructure that copied a command to launch malicious JavaScript disguised as an audio file, but could not confirm that the affected user visited that specific page.

The delivery chain used multiple JavaScript and PowerShell layers, character encoding, AES encryption, XOR operations, and misleading file extensions to retrieve and decode additional payloads. Several antivirus vendors classified the extracted executable as Heracles Trojan, while Hexastrike assessed it as another Lumma Stealer stager. The technique exploits mshta.exe, a legitimate Windows HTML Application utility documented by LOLBAS as supporting malicious script execution and payload retrieval, mapped to MITRE ATT&CK T1218.005 and T1105. Defenders should prioritize monitoring unexpected mshta.exe and PowerShell execution, restrict mshta.exe where operationally feasible, and warn users that legitimate CAPTCHA checks do not require running operating-system commands.