Hackers Deploy Fake CAPTCHA Scam to Steal Crypto Wallet Data via Lumma Stealer Malware

Cryptocurrency users face a growing threat from sophisticated phishing campaigns deploying fake CAPTCHA pages. Researchers at DNSFilter uncovered a scheme where attackers mimic "I'm not a robot" verification prompts to deliver Lumma Stealer—a fileless malware capable of exfiltrating browser-stored credentials and crypto wallet information.

The attack vector was first detected when users of a Greek banking site encountered a fraudulent CAPTCHA overlay. Victims were instructed to paste a malicious PowerShell command, triggering silent execution of the payload. While DNSFilter's defenses blocked the attempt, analysis revealed connections to Cloudflare Pages domains serving as infrastructure for coordinated attacks.

This incident highlights the evolving tactics of cybercriminals targeting digital asset holders. The Lumma Stealer's ability to operate outside browsers makes it particularly dangerous, bypassing traditional security measures while harvesting sensitive cryptocurrency wallet data.