“DeceptionAds” — Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising

Guardio Labs documents a large-scale malvertising campaign in which attackers used Monetag (a PropellerAds subsidiary) and BeMob cloaking to distribute fake captcha pages that coerce users into executing obfuscated PowerShell commands to install the Lumma info-stealer. The campaign delivered roughly 1M ad impressions per day across 3,000+ publisher sites, leveraged cloud/CDN hosting for payload pages, and included detailed IOCs (malicious pages, BeMob URLs, and publisher domains) and a timeline of disclosure and remediation.