Fake Captcha Campaign Highlights Risks of Malvertising Networks

**Executive summary:** A large-scale malvertising campaign distributed the Lumma infostealer through fake captcha pages embedded in ads, leveraging Monetag/PropellerAds infrastructure and tracking services to redirect users, execute PowerShell installers, and harvest credentials and financial data; researchers observed over 1 million daily ad impressions across thousands of sites and reported sophisticated cloaking and account-swapping tactics that allowed the campaign to evade moderation until researchers and providers took action.