CAPTCHA Chaos: From X Threads to Telegram

This report describes a campaign targeting cryptocurrency communities where attackers hijack X threads to lure victims into Telegram groups and present fake ‘Safeguard’ verification bots; victims are coerced into running clipboard commands or mshta/HTA payloads that deploy loaders (IDAT/Hijack and Emmenthal) which ultimately deliver the Lumma Stealer infostealer. The report details the infection chain, device-specific behaviors (mobile, macOS, Windows), obfuscated in-memory execution techniques, and provides C2 domains and file hashes as IOCs.