Malicious ads push Lumma infostealer via fake CAPTCHA pages

Guardio Labs and Infoblox researchers identified a large-scale malvertising campaign dubbed “DeceptionAds” that leveraged the Monetag ad network to push fake CAPTCHA pages which silently copy a malicious PowerShell command to victims' clipboards; when executed via the Windows Run dialog the command installs the Lumma Stealer info-stealer, which exfiltrates browser credentials, cookies, crypto wallets and sensitive files. The campaign used cloaking (BeMob) to evade moderation, delivered over a million daily ad impressions across thousands of sites (notably pirated streaming/software portals), was partially disrupted by ad platforms but showed attempts to resurface, and poses significant risk to end users and organizations due to credential theft and downstream fraud or breaches.