Lumma Stealer Expands Attack Surface with Fake Booking Sites and CAPTCHA Tricks

The campaign’s infection chain was first detected in early 2025, targeting users booking trips to Palawan, Philippines. Within a week, the attack vector shifted to a hotel in Munich, Germany, indicating a broader global focus on travel-related sites.