Winsage
March 8, 2025
Recent investigations from Palo Alto have revealed the use of "click fix" campaigns for distributing Lumma Stealer malware, which exploit user interaction by embedding malicious scripts into the copy-paste buffer. Victims are tricked into executing harmful commands through seemingly benign instructions on malicious web pages.
Key tactics include:
- Domain Impersonation: Registering domains that resemble legitimate services (e.g., windows-update[.]site).
- Abuse of Trusted Platforms: Hosting malicious pages on reputable platforms like Google Sites.
- PowerShell Script Delivery: Using data binaries that execute as PowerShell scripts.
- DLL Side-Loading: Distributing zip archives with decoy files alongside legitimate executables for side-loading Lumma Stealer DLLs.
Examples of malicious activity include:
1. Fake Google Meet Page: A fraudulent page instructs users to execute a PowerShell command that downloads a script from tlgrm-redirect[.]icu, leading to the download of Lumma Stealer files from plsverif[.]cfd/1.zip and executing a DLL file (DuiLib_u.dll) through side-loading.
2. Fake Windows Update Site: The site windows-update[.]site prompts users to run a PowerShell command that downloads a file from overcoatpassably[.]shop/Z8UZbPyVpGfdRS/maloy[.]mp4, which functions as a PowerShell script.
Malicious traffic patterns include HTTP POST requests to tlgrmverif[.]cyou/log.php and downloads from plsverif[.]cfd and overcoatpassably[.]shop.
Active command-and-control (C2) domains for Lumma Stealer are:
- web-security3[.]com
- techspherxe[.]top
Inactive C2 domains include:
- hardswarehub[.]today
- earthsymphzony[.]today
Key files associated with these campaigns are:
- A PowerShell script from tlgrm-redirect[.]icu/1.txt (SHA256: 909ed8a135…).
- A zip archive from plsverif[.]cfd/1.zip (SHA256: 0608775a345…).
- A side-loaded DLL (DuiLib_u.dll, SHA256: b3e8b610ef…).
Indicators of compromise include active domains like windows-update[.]site and sites[.]google[.]com/view/get-access-now-test/verify-your-account, and associated domains such as authentication-safeguard[.]com, plsverif[.]cfd, and tlgrmverif[.]cyou.