Fake CAPTCHA Attacks Exploit Key Entry Point for LummaStealer Malware

Fake CAPTCHA attacks are now a key entry point for a new wave of LummaStealer infections, with CastleLoader loaders turning simple web clicks into full system compromise.

Less than a year after a major law-enforcement takedown, the infostealer’s operators have rebuilt at scale and are again harvesting credentials, crypto wallets, and personal data worldwide.

LummaStealer first appeared on Russian-language forums in late 2022 and has since grown into one of the most prolific information-stealing malware families targeting Windows.

Sold under a malware-as-a-service model, it is leased to affiliates who use it to steal browser passwords, cookies, 2FA tokens, cryptocurrency wallets, VPN profiles, and other sensitive files that enable account takeover and financial fraud.

In May 2025, Microsoft and partners disrupted more than 2,300 Lumma command-and-control (C2) domains, but the takedown only slowed the operation.

Bitdefender researchers have discovered a surge in LummaStealer activity, showing how one of the world’s most prolific information-stealing malware operations.

Operators quickly migrated to bulletproof hosting and alternative loaders, and recent telemetry shows LummaStealer activity surging again across India, the US, and Europe.

Fake CAPTCHAs and ClickFix

Most new infections stem from social engineering rather than software exploits. Common lures include cracked software installers, fake game setups, movie torrents with double extensions like “.mp4.exe,” and deceptive “human verification” pages.

The most worrying trend is the rise of fake CAPTCHA, or “ClickFix,” attacks, where a web page instructs users to press Win+R and paste clipboard content to “fix” an error or prove they are human.

Downloads are usually packaged as self-extracting archives or NSIS installers, formats that closely resemble legitimate software distribution.

In reality, the page has copied a PowerShell one-liner to the clipboard that, once run, downloads and executes a loader directly from the attacker’s infrastructure, often leading to CastleLoader and then LummaStealer.

This technique abuses human trust and routine troubleshooting habits instead of exploiting technical flaws.

CastleLoader has emerged as a central delivery mechanism in current Lumma campaigns. Often compiled as AutoIt executables or scripts, it executes entirely in memory, uses heavy obfuscation and junk code, performs sandbox and antivirus checks, and then decrypts and loads the Lumma payload.

Researchers have identified a distinctive behavior: CastleLoader triggers failed DNS lookups for randomly generated domains in a <string>.<string> format, creating anomalous DNS events that can be used as a detection signal.

Multiple clusters in our telemetry reflect this pattern, with execution originating from WinRAR extraction paths or user download directories before transitioning into CastleLoader-driven execution chains. 

Persistence is commonly achieved through startup shortcuts, scheduled tasks, and files placed under benign-looking paths such as “CraftStitch Studios Inc,” helping the loader blend into normal system activity.

Mitigations

Infrastructure overlap between CastleLoader and LummaStealer malware operators close cooperation or shared service providers inside a broader cybercrime ecosystem.

Lumma stealer is still prevalent globally, with active infections observed mostly in India but also in the US and Europe. The investigation covered a period of one month, between December 12 and January 12.

Recorded Future has linked CastleLoader to the threat actor “GrayBravo” and documented multiple CastleLoader clusters serving different customers, consistent with a loader being reused across several malware families.

This shared ecosystem enables rapid recovery after takedowns: by rotating domains, hosting, and loaders, Lumma operators can quickly restore operations even when thousands of C2 endpoints are seized.

The result is a resilient infostealer platform that fuels credential theft, identity fraud, and extortion at scale.

Because these campaigns depend on user actions, defenses must prioritize behavior and awareness over signatures alone.

Security teams should flag any site asking users to run PowerShell or command-line commands, monitor for suspicious process chains and living-off-the-land tools, and watch for anomalous DNS lookups matching CastleLoader patterns discovered.

Users and organizations should avoid pirated software and unofficial media sources, enforce multi-factor authentication, and rotate passwords and invalidate sessions immediately if compromise is suspected.

As fake CAPTCHA attacks spread, recognizing that “click to verify you’re human” can now mean “execute attacker code” is critical to staying ahead of LummaStealer’s new wave of campaigns.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.