NCERT Warns of Lumma Stealer Malware Spread Through Fake CAPTCHA PDFs

ISLAMABAD: The National Computer Emergency Response Team (NCERT) has issued a warning about a new phishing campaign spreading Lumma Stealer malware through fake CAPTCHA images embedded in PDF files. This large-scale attack has targeted thousands of users across the technology, financial services, and manufacturing sectors, particularly in North America, Asia, and Southern Europe.

Cybercriminals are leveraging search engine manipulation to distribute malicious PDFs that redirect users to deceptive websites. These sites either capture sensitive financial information or deploy Lumma Stealer malware through PowerShell scripts using MSHTA commands. The PDFs, hosted on platforms such as PDFCOFFEE, PDF4PRO, and Internet Archive, appear legitimate in search results, increasing the risk of users falling victim to the scam.

Lumma Stealer, a Malware-as-a-Service (MaaS) tool, is capable of extracting login credentials, browser cookies, and cryptocurrency wallet information. Additionally, it installs GhostSocks, a proxy malware that exploits victims’ internet connections. Stolen data is reportedly being sold on underground forums like Leaky[.]pro. Malicious domains linked to this campaign include pdf-freefiles[.]com, webflow-docs[.]info, secure-pdfread[.]site, and docsviewing[.]net.

In response, NCERT has advised organizations to implement strict cybersecurity measures. Recommendations include educating employees about phishing risks, deploying advanced endpoint protection, blocking malicious domains, and enforcing multi-factor authentication (MFA). Restricting PowerShell and MSHTA execution and monitoring search engine results for fraudulent domains are also crucial steps to mitigate the spread of Lumma Stealer malware.

The advisory emphasizes the increasing sophistication of cyber threats and urges organizations to adopt a proactive approach to cybersecurity. Key practices include regular software updates, limiting administrative privileges, and utilizing application whitelisting. As cybercriminals continue to enhance their tactics, staying vigilant and strengthening security protocols is essential to prevent significant data breaches.