# DeceptionAds: Malvertising Fake CAPTCHA Campaign Delivering Lumma Infostealer via Monetag and BeMob

> Guardio Labs reported the DeceptionAds malvertising campaign: ads on 3,000+ content sites (1M+ daily impressions) redirect validated visitors, via BeMob cloaking, to fake CAPTCHA pages that copy a PowerShell command to the clipboard and instruct the victim to run it from the Windows Run dialog, installing the Lumma infostealer. The campaign abused the Monetag ad network and is linked to the actor Infoblox tracks as Vane Viper (Omnatuor).

- **Published:** 2026-10-16T17:21:32Z
- **Last reviewed:** 2026-10-16T17:21:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3761
- **ID:** TL-2026-3761
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Vane Viper
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

DeceptionAds is a large-scale malvertising operation documented by Guardio Labs (Nati Tal) in December 2024. Threat actors registered as advertisers on the Monetag ad network (a PropellerAds subsidiary) and bought ad placements that ran across more than 3,000 publisher sites, producing over one million ad impressions per day and, per Guardio, thousands of daily victims. Heavily trafficked publishers included streaming sites (hianime.to, sflix.to, gomovies.sx), media converters (y2mate.com, y2meta.tube), ebook piracy (z-lib.io) and game piracy sites (steamrip.com, 9minecraft.net).

The ad code is obfuscated JavaScript that performs browser fingerprinting, tracking and ad-blocker circumvention, and checks that the visitor looks like a real person. Validated visitors are redirected through a Monetag traffic distribution system and the BeMob ad-tracking platform, which the actors used solely as a cloaking layer: reviewers see a benign destination while real victims are sent to a malicious page. BeMob cloaking URLs followed the pattern xxxx.bmtrck.com and /go/[UUID] on 100+ domains across several networks (e.g. addonclicks, fineclouding, smartlinkoffer).

The landing pages are fake CAPTCHA / 'verify you are human' pages hosted on cheap cloud and CDN storage: Bunny CDN (b-cdn.net), Cloudflare R2 (r2.dev), Oracle Cloud object storage, Scaleway and EXOScale (and Netlify per Rewterz). Page JavaScript silently copies a malicious PowerShell one-liner to the clipboard and instructs the victim to paste it into the Windows Run dialog (ClickFix-style user execution). Guardio observed multiple obfuscation techniques and design variants over the campaign. The command downloads and runs Lumma Stealer, which harvests cookies, credentials, passwords, credit cards and browsing history from Chrome, Edge, Firefox and other Chromium browsers, plus cryptocurrency wallets and files with names such as seed.txt and trezor.txt. Guardio did not publish the PowerShell commands or hashes.

Monetag removed 200+ threat actor accounts on 2024-11-28 (8 days after disclosure) and BeMob removed the cloaking accounts within 4 days, but activity paused only briefly and resumed using Monetag and other ad networks; BleepingComputer observed a resurgence on 2024-12-11. Guardio highlights the fragmented chain of responsibility (advertisers, ad network, tracking service, publishers, hosting) that gives plausible deniability. Infoblox ties Monetag to PropellerAds and AdTech Holding (Cyprus) and tracks the associated malvertising infrastructure as Vane Viper / Omnatuor. Specific network IOCs for this campaign are limited to the landing-page URLs republished by Rewterz; no IP addresses or file hashes were published, so no BeaconBeagle lookups were possible.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1583.006 Web Services
- T1608.004 Drive-by Target
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1027 Obfuscated Files or Information
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1560 Archive Collected Data

## Sources

- ["DeceptionAds" - Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising (Guardio Labs, mirror)](https://www.infostealers.com/?p=4497)
- [DeceptionAds - Fake Captcha Driving Infostealer Infections (Guardio Labs, Medium)](https://medium.com/@guardiosecurity/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6)
- [Malicious ads push Lumma infostealer via fake CAPTCHA pages (BleepingComputer)](https://bleepingcomputer.com/news/security/malicious-ads-push-lumma-infostealer-via-fake-captcha-pages)
- [Fake CAPTCHA pages used to spread infostealer malware (TechRadar)](https://www.techradar.com/pro/security/fake-captcha-pages-used-to-spread-infostealer-malware)
- [DeceptionAds uses 3000 sites and fake CAPTCHA pages to deliver over million impressions daily - Active IOCs (Rewterz)](https://rewterz.com/threat-advisory/deceptionads-uses-3000-sites-and-fake-captcha-pages-to-deliver-over-million-impressions-daily-active-iocs)
- [Засев Lumma Stealer через CAPTCHA прикрыли легальными рекламными сервисами (Anti-Malware.ru)](https://www.anti-malware.ru/news/2024-12-17-114534/44859)
- ['Vane Viper' Threat Group Tied to PropellerAds, Commercial Entities (Dark Reading)](https://www.darkreading.com/vulnerabilities-threats/vane-viper-threat-group-propellerads)
- [Vane Viper Generates 1 Trillion DNS Queries (The Hacker News)](https://thehackernews.com/2025/09/vane-viper-generates-1-trillion-dns.html)
- [New research uncovers large scale malicious ad network (Infoblox via iTWire)](https://itwire.com/guest-articles/guest-research/new-research-uncovers-large-scale-malicious-ad-network,-illuminating-connection-between-adtech-platforms-and-malicious-actors)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3761