Russian risk actors have been leveraging trusted cloud infrastructure platforms like Oracle Cloud Infrastructure (OCI) Object Storage and Scaleway Object Storage to propagate subtle assaults utilizing the Lumma Stealer malware.
This malware-as-a-service (MaaS) infostealer, often known as LummaC2 Stealer, targets Home windows methods to siphon credentials, system information, and cryptocurrency wallets.
Investigations carried out in 2025 reveal a calculated shift in supply mechanisms, with attackers exploiting pretend reCAPTCHA pages hosted on legit cloud providers to trick customers significantly high-access people inside organizations into executing malicious instructions.
Using developer-friendly platforms like OCI and Scaleway, coupled with the concentrating on of privileged customers, raises vital considerations about potential lateral motion and deeper community compromise inside enterprise environments.
Evolving Ways of Lumma Stealer Campaigns
Since February 2025, risk actors have been noticed utilizing Tigris Object Storage to host misleading reCAPTCHA pages that immediate customers to execute malicious PowerShell instructions by way of the Home windows Run dialog (Home windows + R).
These instructions, typically obfuscated and copied to the clipboard, silently launch legit binaries like mshta.exe to fetch trojans disguised as benign information, resembling “sports activities[.]mp4” from suspicious domains with top-level domains (TLDs) like .store.
By March, the marketing campaign had prolonged to OCI Object Storage, and by Might 2025, Scaleway Object Storage turned the most recent platform exploited for internet hosting related malicious content material.
Evaluation of Doc Object Mannequin (DOM) samples from these pages uncovered Russian-language feedback phrases like “Rubbish HTML code” and “Obfuscated code with rubbish decoy features” suggesting a attainable connection to Russian-speaking attackers.
Whereas not conclusive proof of attribution, these annotations point out a deliberate effort to mislead safety analysts and streamline the attackers’ workflow for debugging and collaboration.
This exploitation of trusted infrastructure not solely aids in evading preliminary detection but in addition capitalizes on Scaleway’s comparatively decrease safety visibility in comparison with different extensively monitored platforms, permitting malicious content material to persist longer.
Cloud Supplier Response
Additional compounding the difficulty, Lumma Stealer campaigns have diversified their targets, with earlier efforts in 2024 specializing in gaming fanatics by way of malvertising and Steam impersonation, now evolving to take advantage of technically proficient customers in 2025.
Based on the Report, Safety measures by Cato Networks, via their MDR service, have proactively blocked redirection makes an attempt to those pretend reCAPTCHA pages utilizing high-confidence IPS guidelines, safeguarding customers earlier than interplay.
Responses from the affected cloud suppliers fluctuate: Tigris confirmed the elimination of reported malicious content material and printed tips on combating platform abuse, Scaleway took steps to eradicate the pretend pages from their infrastructure, whereas Oracle has but to reply.
The persistent evolution of Lumma Stealer supply techniques underscores the crucial want for steady behavioral evaluation and contextual detection to counter such threats.
As attackers leverage trusted environments to bypass conventional defenses, organizations should stay vigilant, adopting superior risk intelligence and prevention mechanisms to guard towards these subtle campaigns.
Indicators of Compromise (IoCs)
| Sort | Indicator | Description |
|---|---|---|
| URL | objectstorage[.]ap-seoul-1[.]oraclecloud[.]com/n/id0cu93izlqm/b/need-to-complete-this/o/dest[.]html | Internet hosting malicious CAPTCHA |
| URL | datastream-dist[.]s3[.]pl-waw[.]scw[.]cloud/pass-this-for-access-prism[.]html | Internet hosting malicious CAPTCHA |
| URL | amacys[.]store/sports activities[.]mp4 | Malicious HTA masqueraded as different file sort |
Discover this Information Fascinating! Comply with us on Google Information, LinkedIn, & X to Get On the spot Updates!
