Fake CAPTCHA to Data Theft: A Lumma Stealer Campaign Through the Cyber Kill Chain

CAPTCHA has long been a simple security control for telling humans apart from bots. In recent years, though, that same idea has been twisted into an effective lure. One of the clearest examples is the campaign that spreads Lumma Stealer through fake CAPTCHA pages. It relies on almost no technical exploitation. Instead, it leans on careful social engineering and the trust users place in an interface that looks legitimate.

The victim runs the malicious command themselves, convinced they are just "verifying" they are human.

This piece breaks the campaign down with the Cyber Kill Chain, walking each of its seven stages from Reconnaissance to Actions on Objectives.

What is Lumma Stealer?

Lumma Stealer is an information stealer that operates on a Malware-as-a-Service (MaaS) model. The developers provide the platform and infrastructure, while affiliates pay to run their own campaigns on top of it. Its targets are high-value data: browser credentials, cookies and session tokens, autofill data, and cryptocurrency wallets.

In the fake CAPTCHA variant, the victim lands on a page showing a professional, convincing verification prompt. Instead of ticking a box or picking images, the page hands out technical instructions, typically to open the Windows Run dialog and paste in a command. When that command runs, the victim's own machine downloads and executes Lumma Stealer.

The technique works precisely because it is simple. Nothing malicious is downloaded by a click, and no operating-system flaw is exploited. The user is the one who, unknowingly, runs the harmful command.

Dissecting the attack with the Cyber Kill Chain

1. Reconnaissance

The attackers first look for the context and vectors most likely to catch victims. They study popular search terms such as pirated software, free streaming, or in-demand digital services, and they count on casual users who tend to skip technical detail during a "security verification." The result is a broad but relevant target pool, which keeps the odds of interaction high.

2. Weaponization

Here the "weapon" is built: the fake CAPTCHA page and its supporting scripts. The page is designed to resemble a legitimate security service, complete with logos, technical jargon, and messaging that manufactures urgency. Behind the scenes, the attackers prepare an obfuscated PowerShell or command-line one-liner that pulls the Lumma Stealer payload from their server. That payload is usually modular, so it can be updated or reconfigured as the campaign needs.

3. Delivery

Delivery happens through several channels:

• SEO poisoning, so the malicious site ranks near the top of search results.
• Malvertising and ad redirects.
• Phishing, over email or instant messaging.

A victim who clicks is routed to the fake CAPTCHA page. At this point nothing is installed yet; the attack still depends on further interaction.

4. Exploitation

Unlike classic attacks, exploitation here involves no software vulnerability. The target is the human. The instructions convince the victim they are performing a normal security step, so copying and running the provided command effectively executes a malicious script on their own system. On these pages the encrypted PowerShell is often copied to the clipboard automatically, and the victim is told to press Win+R, paste with Ctrl+V, and hit Enter. That is the core of the fake CAPTCHA: it exploits trust and inattention rather than code.

On the fake page, encrypted PowerShell is copied to the clipboard automatically while the victim is walked through running it via the Run dialog. Source: infostealers.com.

5. Installation

Once the command runs, the script downloads Lumma Stealer and executes it. The malware drops itself into a location such as a temporary directory and can set up persistence, for example a registry entry or a scheduled task, so it survives a reboot. At this stage the system is fully compromised.

6. Command and Control (C2)

The active stealer establishes communication with the attacker's Command and Control server. Through this channel it exfiltrates the collected data and can receive further instructions. C2 infrastructure is usually built to be flexible, using many domains or backup servers to resist takedown. This channel is the backbone of the operation, letting attackers monitor and manage infections at scale.

7. Actions on Objectives

The final stage is the payoff: stealing and using data. Lumma Stealer harvests login credentials, session cookies, crypto wallet data, and other sensitive information. That data is then used for account takeover, digital-asset theft, or resale on underground markets. In some cases the compromised machine becomes an entry point for follow-on attacks, such as deploying other malware or running more elaborate fraud.

Impact and security implications

This campaign shows that modern threats do not always depend on complex technical tricks. With well-targeted social engineering, attackers can slip past traditional security layers and infect systems at scale. For individuals, the fallout can be lost accounts and digital assets. For organizations, an infection like this risks data breaches, financial loss, and reputational damage.

Takeaways

Mapping the campaign onto the Cyber Kill Chain shows a structured, systematic attack, even though it looks simple on the surface. Each stage is engineered to maximize success by combining technology with user psychology.

The main defenses are human: user awareness, restricting script execution, and basic security education. Practical guardrails help too, such as being suspicious of any "verification" that asks you to open Run or paste a command, and locking down PowerShell where it is not needed. In an evolving threat landscape, understanding attack flows like this is no longer optional.

References

• Microsoft Threat Intelligence (2025). Breaking down the delivery techniques and capabilities of the Lumma Stealer infostealer. Microsoft Security Blog.
• Netskope Threat Labs (2025). Lumma Stealer: Fake CAPTCHA campaigns and new evasion techniques. Netskope Blog.
• Hutchins, Cloppert, and Amin. Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Lockheed Martin Corporation.
• Anatomy of a Lumma Stealer attack via fake CAPTCHA pages, infostealers.com.