DNS Early Detection - Fast Propagating Fake Captcha distributes LummaStealer
Essential information
- Published
- 28/02/2025 10:36
- Modified
- 28/02/2025 11:12
- Tags
- 2025-02-27 2025-02-28 adtech dns traffic analysis dns-monitoring early detection fake captcha information stealer lummac2 lummastealer malicious domains malware-as-a-service
- Related entities
- 11 observables, 9 techniques (mitre), 2 malware
Description
Between October 2024 and February 2025, LummaStealer malware was distributed via fake CAPTCHA pages, targeting users who store sensitive information in browsers and cryptocurrency wallets. The malware, available as a Malware-as-a-Service, collects data for fraud and unauthorized access. Threat actors use fake CAPTCHA to establish trust and initiate obfuscated scripts, leading to secondary payloads and lateral movements. Infoblox's DNS monitoring detected malicious domains an average of 46.8 days before public reports, providing early protection for customers. Given the easy access to malicious adtech services and fake CAPTCHA content, continued and increased usage by threat actors is expected.