Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://infosec.exchange/users/decio/statuses/113664316708774073">:mastodon: decio (decio@infosec.exchange)'s status on Tuesday, 30-Dec-2025 00:23:23 JST</a><a href="https://infosec.exchange/@decio" title="decio@infosec.exchange"><img src="https://gnusocial.jp/avatar/299111-48-20250626135528.webp" width="48" height="48" alt=":mastodon: decio" style="position: absolute; left: 0; top: 0;">:mastodon: decio</a><div><a href="https://infosec.exchange/@decio/113640099528814694" rel="in-reply-to">in reply to</a></div></section><article><p>et ça continue... </p><p>Variante exploitant les services de campagnes publicitaires en ligne pour balancer des pages ClickFix lors de la navigation</p><p>Une campagne de malvertising de type "ClickFix", nommée "DeceptionAds", exploite le réseau publicitaire légitime Monetag pour rediriger les internautes vers de fausses pages CAPTCHA. Ces dernières incitent les victimes à exécuter manuellement une commande PowerShell malveillante, installant toujours et encore, le malware Lumma Stealer. Bien que l’opération ait été interrompue, les attaquants ont tenté de reprendre leurs activités via d’autres réseaux publicitaires.<br>⬇️ <br>“DeceptionAds” — Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising"<br>👇 <br><a href="https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6" rel="nofollow">https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6</a></p><p>[dans les  news infosec]<br>⬇️ <br>Malicious ads push Lumma infostealer via fake CAPTCHA pages<br>👇 <br><a href="https://www.bleepingcomputer.com/news/security/malicious-ads-push-lumma-infostealer-via-fake-captcha-pages/" rel="nofollow">https://www.bleepingcomputer.com/news/security/malicious-ads-push-lumma-infostealer-via-fake-captcha-pages/</a></p><p><a href="https://infosec.exchange/tags/CyberVeille" rel="tag">#CyberVeille</a> <a href="https://infosec.exchange/tags/Clickfix" rel="tag">#Clickfix</a> <a href="https://infosec.exchange/tags/LummaStealer" rel="tag">#LummaStealer</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/6002083#notice-11810489">In conversation</a><time datetime="2025-12-30T00:23:23+09:00" title="Tuesday, 30-Dec-2025 00:23:23 JST">about 10 months ago</time> <span>from <span><a href="https://infosec.exchange/@decio/113664316708774073" rel="external" title="Sent from infosec.exchange via ActivityPub">infosec.exchange</a></span></span><a href="https://infosec.exchange/@decio/113664316708774073">permalink</a><h4>Attachments</h4><ol><li><label><a rel="external" href="https://gnusocial.jp/attachment/5613927">Le processus des faux CAPTCHA : contraindre les visiteurs d'un site à exécuter à leur insu une commande PowerShell. (gif from  original article by Guardio Labs  https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6)</a></label><br><video poster="" controls="controls"><source src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/664/306/645/907/930/original/8c08bd1f8de18f0b.mp4" type="video/mp4"></source></video></li><li><label><a rel="external" href="https://gnusocial.jp/attachment/5613929">Untitled attachment</a></label><br></li><li><article><header><div>Domain not in remote thumbnail source whitelist: www.bleepstatic.com</div><h5><a href="https://www.bleepingcomputer.com/news/security/malicious-ads-push-lumma-infostealer-via-fake-captcha-pages/#CyberVeille">Malicious ads push Lumma infostealer via fake CAPTCHA pages</a></h5><div> from <span>@BleepinComputer</span></div></header><div>A large-scale malvertising campaign distributed the Lumma Stealer info-stealing malware through fake CAPTCHA verification pages that prompt users to run PowerShell commands to verify they are not a bot.</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
:mastodon: decio (decio@infosec.exchange)'s status on Tuesday, 30-Dec-2025 00:23:23 JST :mastodon: decio
in reply to
et ça continue...
Variante exploitant les services de campagnes publicitaires en ligne pour balancer des pages ClickFix lors de la navigation
Une campagne de malvertising de type "ClickFix", nommée "DeceptionAds", exploite le réseau publicitaire légitime Monetag pour rediriger les internautes vers de fausses pages CAPTCHA. Ces dernières incitent les victimes à exécuter manuellement une commande PowerShell malveillante, installant toujours et encore, le malware Lumma Stealer. Bien que l’opération ait été interrompue, les attaquants ont tenté de reprendre leurs activités via d’autres réseaux publicitaires.
⬇️
“DeceptionAds” — Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising"
👇
https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
[dans les news infosec]
⬇️
Malicious ads push Lumma infostealer via fake CAPTCHA pages
👇
https://www.bleepingcomputer.com/news/security/malicious-ads-push-lumma-infostealer-via-fake-captcha-pages/
#CyberVeille #Clickfix #LummaStealer
In conversationabout 10 months ago from infosec.exchangepermalink
Attachments
1. Le processus des faux CAPTCHA : contraindre les visiteurs d'un site à exécuter à leur insu une commande PowerShell. (gif from original article by Guardio Labs https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6)
2. Untitled attachment
3. Domain not in remote thumbnail source whitelist: www.bleepstatic.com
  Malicious ads push Lumma infostealer via fake CAPTCHA pages
  from @BleepinComputer
  A large-scale malvertising campaign distributed the Lumma Stealer info-stealing malware through fake CAPTCHA verification pages that prompt users to run PowerShell commands to verify they are not a bot.

Public

Embed Notice

HTML Code

Corresponding Notice