Threat reportMalwareTL-2026-3761
DeceptionAds: Malvertising Fake CAPTCHA Campaign Delivering Lumma Infostealer via Monetag and BeMob
DeceptionAds (TL-2026-3761), also tracked as DeceptionAds, is a high-severity malware campaign, first published 2026-10-16. It is attributed to Vane Viper with medium confidence, affects Microsoft Windows (Run dialog / PowerShell), maps to 10 MITRE ATT&CK techniques (T1005, T1027, T1059.001), and is covered by 9 detection rules and 21 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 1Vane Viper
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 21Indicators of compromise
Key facts for TL-2026-3761
- Threat ID
- TL-2026-3761
- Also known as
- DeceptionAds
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Vane Viper
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- consumer, general-public
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in DeceptionAds
Malware and tooling: Lumma Stealer - S1213, BeMob
How DeceptionAds works
Guardio Labs reported the DeceptionAds malvertising campaign: ads on 3,000+ content sites (1M+ daily impressions) redirect validated visitors, via BeMob cloaking, to fake CAPTCHA pages that copy a PowerShell command to the clipboard and instruct the victim to run it from the Windows Run dialog, installing the Lumma infostealer. The campaign abused the Monetag ad network and is linked to the actor Infoblox tracks as Vane Viper (Omnatuor).
DeceptionAds is a large-scale malvertising operation documented by Guardio Labs (Nati Tal) in December 2024. Threat actors registered as advertisers on the Monetag ad network (a PropellerAds subsidiary) and bought ad placements that ran across more than 3,000 publisher sites, producing over one million ad impressions per day and, per Guardio, thousands of daily victims. Heavily trafficked publishers included streaming sites (hianime.to, sflix.to, gomovies.sx), media converters (y2mate.com, y2meta.tube), ebook piracy (z-lib.io) and game piracy sites (steamrip.com, 9minecraft.net).
The ad code is obfuscated JavaScript that performs browser fingerprinting, tracking and ad-blocker circumvention, and checks that the visitor looks like a real person. Validated visitors are redirected through a Monetag traffic distribution system and the BeMob ad-tracking platform, which the actors used solely as a cloaking layer: reviewers see a benign destination while real victims are sent to a malicious page. BeMob cloaking URLs followed the pattern xxxx.bmtrck.com and /go/[UUID] on 100+ domains across several networks (e.g. addonclicks, fineclouding, smartlinkoffer).
The landing pages are fake CAPTCHA / 'verify you are human' pages hosted on cheap cloud and CDN storage: Bunny CDN (b-cdn.net), Cloudflare R2 (r2.dev), Oracle Cloud object storage, Scaleway and EXOScale (and Netlify per Rewterz). Page JavaScript silently copies a malicious PowerShell one-liner to the clipboard and instructs the victim to paste it into the Windows Run dialog (ClickFix-style user execution). Guardio observed multiple obfuscation techniques and design variants over the campaign. The command downloads and runs Lumma Stealer, which harvests cookies, credentials, passwords, credit cards and browsing history from Chrome, Edge, Firefox and other Chromium browsers, plus cryptocurrency wallets and files with names such as seed.txt and trezor.txt. Guardio did not publish the PowerShell commands or hashes.
Monetag removed 200+ threat actor accounts on 2024-11-28 (8 days after disclosure) and BeMob removed the cloaking accounts within 4 days, but activity paused only briefly and resumed using Monetag and other ad networks; BleepingComputer observed a resurgence on 2024-12-11. Guardio highlights the fragmented chain of responsibility (advertisers, ad network, tracking service, publishers, hosting) that gives plausible deniability. Infoblox ties Monetag to PropellerAds and AdTech Holding (Cyprus) and tracks the associated malvertising infrastructure as Vane Viper / Omnatuor. Specific network IOCs for this campaign are limited to the landing-page URLs republished by Rewterz; no IP addresses or file hashes were published, so no BeaconBeagle lookups were possible.
MITRE ATT&CK techniques used in TL-2026-3761
Collection
T1005 Data from Local System; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information
Execution
T1059.001 PowerShell; T1204.004 Malicious Copy and Paste
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Resource Development
T1583.006 Web Services; T1583.008 Malvertising; T1608.004 Drive-by Target
Affected products and versions in DeceptionAds
- Microsoft — Windows (Run dialog / PowerShell)
Vulnerable versions: Windows endpoints used with ad-supported websites; no software vulnerability, social-engineering technique - Various — Chrome, Edge, Firefox and other Chromium browsers (credential and cookie theft targets)
Vulnerable versions: All versions storing credentials/cookies locally
Remediation for DeceptionAds
Immediate actions
- Block the listed fake-CAPTCHA landing-page domains/URLs and bmtrck.com cloaking redirects at DNS/proxy
- Hunt for powershell.exe/mshta.exe/cmd.exe spawned from explorer.exe shortly after a Run dialog (RunMRU) entry
- If a user ran a pasted command, isolate the host, reset all browser-stored credentials and revoke active sessions/cookies, and move crypto wallet funds
Workarounds
- Disable the Windows Run dialog via Group Policy (NoRun) where operationally feasible
- Enable PowerShell Constrained Language Mode and AppLocker/WDAC for non-admin users
Longer-term hardening
- Train users that legitimate CAPTCHAs never require pasting commands into Run, PowerShell or Terminal
- Deploy EDR with PowerShell script-block logging and behavioral detection of clipboard-to-Run execution
- Use DNS filtering and ad/malvertising blocking on managed browsers; restrict access to piracy/streaming sites
Timeline of DeceptionAds
- Infoblox first documents the Vane Viper / Omnatuor malvertising network (August 2022; exact day not stated), later tied to PropellerAds and AdTech Holding.
- Per the Guardio report, the campaign is already actively distributing Lumma Stealer via fake CAPTCHA pages in early November 2024 (exact day not stated).
- Guardio Labs disclosed findings to Monetag and BeMob; date derived from the reported 8-day gap to Monetag's 2024-11-28 account removal.
- BeMob removes the cloaking accounts within 4 days of disclosure (date derived from the 4-day interval).
- Monetag removes 200+ threat actor accounts, 8 days after Guardio's responsible disclosure; BeMob removes the cloaking accounts within 4 days of disclosure.
- BleepingComputer reports the fake CAPTCHA campaign resurging after a brief pause, using Monetag and other ad networks.
- Guardio Labs (Nati Tal) publishes the DeceptionAds report: 1M+ daily impressions, 3,000+ publisher sites, thousands of daily victims, Lumma Stealer payload.
- Anti-Malware.ru and other outlets publish coverage of the Guardio findings, noting the abuse of legitimate ad services to seed Lumma Stealer.
- Infoblox publishes further Vane Viper research (about 1 trillion DNS queries, tied to PropellerAds/AdTech Holding); reported by The Hacker News in September 2025, exact day not stated.
Sources cited for DeceptionAds
- "DeceptionAds" - Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising (Guardio Labs, mirror)
- DeceptionAds - Fake Captcha Driving Infostealer Infections (Guardio Labs, Medium)
- Malicious ads push Lumma infostealer via fake CAPTCHA pages (BleepingComputer)
- Fake CAPTCHA pages used to spread infostealer malware (TechRadar)
- DeceptionAds uses 3000 sites and fake CAPTCHA pages to deliver over million impressions daily - Active IOCs (Rewterz)
- Засев Lumma Stealer через CAPTCHA прикрыли легальными рекламными сервисами (Anti-Malware.ru)
- 'Vane Viper' Threat Group Tied to PropellerAds, Commercial Entities (Dark Reading)
- Vane Viper Generates 1 Trillion DNS Queries (The Hacker News)
- New research uncovers large scale malicious ad network (Infoblox via iTWire)
Detection coverage for TL-2026-3761
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3761 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.