FAKE CAPTCHA LED TO LUMMA

Summary from the TLDR InfoSec newsletter

Attackers used a fake CAPTCHA page that employed the ClickFix social engineering technique to trick users into pressing Windows+R and pasting a PowerShell command that downloaded LUMMA stealer malware. The malware targeted browser credential stores (Login Data and Web Data) from Microsoft Edge and Google Chrome, establishing C2 communication within minutes of initial execution. The attack chain leveraged multiple evasion techniques, including heavily obfuscated PowerShell, AutoIt scripts, and mshta.exe proxy execution to bypass security controls.