Lumma Stealer Strikes Again with Fake CAPTCHAs and Advanced Evasion

A new Lumma Stealer campaign has emerged, using fake CAPTCHAs, malvertising, and sophisticated payloads to target Windows users worldwide. The attackers employ deceptive tactics, including an infection chain that tricks victims into executing clipboard commands via the Windows Run prompt, effectively bypassing conventional defenses. Notably, one payload leverages code from an open-source tool to bypass the Windows Antimalware Scan Interface (AMSI), disabling malware protections and enabling the attackers to operate undetected within compromised systems.