New LUMMAC.V2 Stealer Using ClickFix Technique to Trick Users in Execute Malicious Commands - Cyber Security News

The LUMMAC.V2 campaign represents a significant threat not only due to its extensive data theft capabilities but also because it exploits human behavior rather than technical vulnerabilities, making traditional security measures less effective at prevention. When victims land on the fake CAPTCHA page, they’re guided to press Windows+R to open the Run dialog box, then instructed to press CTRL+V to paste a command that has been surreptitiously copied to their clipboard, and finally to press Enter to execute it. Google Cloud Security Community researchers have identified that the ClickFix technique forms the cornerstone of LUMMAC.V2’s attack methodology. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This new variant, designated LUMMAC.V2, has been observed targeting a wide range of applications including browsers, cryptocurrency wallets, password managers, remote desktop applications, email clients, and instant messaging platforms. When users click these links, they’re redirected to deceptive websites that present as security verification pages with fake CAPTCHA challenges. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The malware’s primary function is to exfiltrate sensitive information such as credentials, logins, emails, personal details, system information, screenshots, and cookies, subsequently compressing this data into a ZIP archive for transmission over HTTP connections. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. The lifecycle shows an example of this deceptive page in action, while the below image reveals the underlying website’s source code designed to execute this attack. The malware propagates through malicious links embedded in search results, especially those related to cracked software, popular movies, or music releases. This technique tricks users into executing commands without realizing they’re initiating malware installation. The ClickFix technique operates by instructing users to perform seemingly innocuous actions that trigger malware execution. Cybersecurity experts have identified a sophisticated evolution of the LUMMAC credential stealer, now rewritten from C to C++ and operating with enhanced capabilities. What makes LUMMAC.V2 particularly dangerous is its distribution method, which relies heavily on social engineering rather than technical exploits. This command downloads and executes additional malicious payloads, establishing persistence by creating registry entries under HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 05 May 2025 10:40:04 +0000

Cyber News related to New LUMMAC.V2 Stealer Using ClickFix Technique to Trick Users in Execute Malicious Commands - Cyber Security News

New LUMMAC.V2 Stealer Using ClickFix Technique to Trick Users in Execute Malicious Commands - Cyber Security News - The LUMMAC.V2 campaign represents a significant threat not only due to its extensive data theft capabilities but also because it exploits human behavior rather than technical vulnerabilities, making traditional security measures less effective at ...
1 month ago Cybersecuritynews.com

Hackers Employ New ClickFix Captcha Technique to Deliver Ransomware - The integration of Qakbot with the ClickFix technique allows attackers to bypass traditional security measures by leveraging user interaction to execute malicious commands. A sophisticated social engineering technique known as ClickFix has emerged, ...
2 months ago Cybersecuritynews.com

State Sponsored Hackers Now Widely Using ClickFix Attack Technique in Espionage Campaigns - While currently limited to experimental usage by these state-sponsored groups, the increasing popularity of ClickFix in both cybercrime and espionage campaigns suggests the technique will likely become more widely adopted as threat actors continue to ...
2 months ago Cybersecuritynews.com Kimsuky MuddyWater

ClickFix Captcha - A Creative Technique That Allow Attackers Deliver Malware and Ransomware on Windows - This technique, known as ClickFix Captcha, exploits users’ trust in familiar web elements to bypass traditional security measures and deliver malicious payloads to Windows systems. The researchers noted the commands typically invoke PowerShell ...
2 months ago Cybersecuritynews.com

Vidar Stealer With New Deception Technique to Steal Browser Cookies & Stored Credentials - Vidar Stealer, an information-stealing malware first identified in 2018, has evolved with a sophisticated new deception technique targeting cybersecurity professionals and system administrators. G Data security researchers identified an unusual Vidar ...
2 months ago Cybersecuritynews.com

New Android Malware 'Salvador Stealer' That Phish & Steals Your Banking Details & OTPs - Cybersecurity researchers have discovered a sophisticated new Android malware called “Salvador Stealer” that targets banking credentials and one-time passwords (OTPs) through an elaborate phishing scheme. Once active, Salvador Stealer ...
2 months ago Cybersecuritynews.com

The Rise of Cyber Insurance - What CISOs Need to Consider - Cyber insurance offers not just financial protection against potentially devastating cyber incidents but also provides frameworks for improving security posture, access to specialized resources, and support during crisis scenarios. Beyond financial ...
2 months ago Cybersecuritynews.com

Interlock ransomware gang pushes fake IT tools in ClickFix attacks - The Interlock ransomware gang now uses ClickFix attacks that impersonate IT tools to breach corporate networks and deploy file-encrypting malware on devices. Though this isn't the first time ClickFix has been linked to ransomware infections, ...
2 months ago Bleepingcomputer.com

Lumma Stealer Evolves with New PowerShell Tools & Advanced Techniques - “The variations we saw in Lumma Stealer behavior are significant to defenders,” noted the Sophos Managed Detection and Response team in their report, emphasizing that these delivery techniques could easily be adapted for other malware ...
1 month ago Cybersecuritynews.com Kimsuky

New ClickFix Attack Mimics Ministry of Defense Website to Attack Windows & Linux Machines - The attack creates convincing replicas of Ministry of Defense websites across multiple countries, tricking users into downloading what appears to be required security updates or official documents. Initial analysis suggests the campaign began in ...
1 month ago Cybersecuritynews.com

Lampion Banking Malware Employs ClickFix Lures To Steal Banking Information - Once executed, the malware begins its covert operation to harvest banking credentials, credit card information, and other sensitive financial data from compromised systems. A sophisticated banking trojan known as Lampion has resurfaced with an ...
1 month ago Cybersecuritynews.com

Microsoft Warns of Cyber Attack Mimic Booking .com To Deliver Password Stealing Malware - Security analysts at Microsoft noted that this campaign employs a technique called “ClickFix,” which displays fake error messages instructing users to execute commands that download malware. The addition of ClickFix to their tactics shows ...
3 months ago Cybersecuritynews.com

New KoiLoader Abuses Powershell Scripts to Deliver Malicious Payload - Cyber Security News - This updated strain employs PowerShell scripts embedded within Windows shortcut (LNK) files to bypass traditional detection mechanisms, demonstrating a concerning evolution in attack methodologies. eSentire’s Threat Response Unit (TRU) first ...
2 months ago Cybersecuritynews.com

New Stealthy Malware 'Waiting Thread Hijacking' Technique Bypasses Modern Defenses - Unlike traditional thread hijacking, which requires suspending and resuming threads using easily monitored APIs like SuspendThread and ResumeThread, WTH targets threads already in a waiting state, eliminating the need for suspicious thread ...
2 months ago Cybersecuritynews.com

New ClickFix attack deploys Havoc C2 via Microsoft Sharepoint - A newly uncovered ClickFix phishing campaign is tricking victims into executing malicious PowerShell commands that deploy the Havok post-exploitation framework for remote access to compromised devices. Threat actors have also begun to evolve the ...
3 months ago Bleepingcomputer.com

Three Key Threats Fueling the Future of Cyber Attacks - Improvements in cyber security and business continuity are helping to combat encryption-based ransomware attacks, yet the cyber threat landscape is continually evolving. Protecting an organization against intrusion remains a cat and mouse game, in ...
1 year ago Cyberdefensemagazine.com

New MintsLoader Drops GhostWeaver via Phishing & ClickFix Attack - Security researchers have observed a significant spike in targeted attacks against financial institutions and healthcare organizations over the past three weeks, with the malware utilizing a dual-vector approach combining phishing emails and a new ...
1 month ago Cybersecuritynews.com

Uncertainty Is the Biggest Challenge to Australia's Cyber Security Strategy - Political shifts could lead to changes in Australia's cyber security strategy. Early in 2023, as the Australian government started to craft its cyber security vision, it met with opposition at both ends of the political spectrum. On the right wing, ...
1 year ago Techrepublic.com

RedLine Stealer Malware Deployed Via ScrubCrypt Evasion Tool - A new version of the ScrubCrypt obfuscation tool is being used to target organizations with the RedLine Stealer malware, fraud sensor network Human Security has warned. Human's Satori Threat Intelligence Team said it has uncovered the new build of ...
1 year ago Infosecurity-magazine.com

'Ov3r Stealer' Malware Spreads Through Facebook to Steal Crates of Info - The malware by design exfiltrates specific types of data such as geolocation, hardware info, passwords, cookies, credit card information, auto-fills, browser extensions, crypto wallets, Office documents, and antivirus product information, according ...
1 year ago Darkreading.com

New Germlin Stealer Advertised on Hacker Forums Steals Credit Card Data & Login Credentials - Cyber Security News - For credit card data theft, Gremlin Stealer employs specialized functions that target stored payment information across multiple browsers. First spotted being advertised on underground forums and Telegram channels, Gremlin Stealer represents a ...
1 month ago Cybersecuritynews.com

Cyber Insurance for Businesses: Navigating Coverage - To mitigate these risks, many businesses opt for cyber insurance. With the wide range of policies available, navigating the world of cyber insurance can be overwhelming. In this article, we will delve into the complexities of cyber insurance and ...
1 year ago Securityzap.com

Cyber Insurance: A Smart Investment to Protect Your Business from Cyber Threats in 2023 - Don't wait until it's too late - get cyber insurance today and secure your business for tomorrow. According to the U.S. Federal Trade Commission, cyber insurance is a particular type of insurance that helps businesses mitigate financial losses ...
1 year ago Cyberdefensemagazine.com

What CIRCIA Means for Critical Infrastructure Providers and How Breach and Attack Simulation Can Help - Cyber Defense Magazine - To prepare themselves for future attacks, organizations can utilize BAS to simulate real-world attacks against their security ecosystem, recreating attack scenarios specific to their critical infrastructure sector and function within that sector, ...
8 months ago Cyberdefensemagazine.com Akira

Sapphire Werewolf Enhances Toolkit With New Amethyst Stealer to Attack Energy Companies - The malware employs a sophisticated multi-stage infection process, first loading a Base64-encoded PE file into memory through Assembly.Load() and Invoke() methods, avoiding writing the malicious payload to disk where it might be detected by security ...
2 months ago Cybersecuritynews.com