Russian Hackers Exploit Oracle Cloud Infrastructure to Target Scaleway Object Storage

Russian threat actors have been utilizing cloud infrastructure platforms such as Oracle Cloud Infrastructure (OCI) Object Storage and Scaleway Object Storage to execute attacks using the Lumma Stealer malware.

This malware-as-a-service (MaaS) infostealer, also known as LummaC2 Stealer, targets Windows systems to extract credentials, system data, and cryptocurrency wallets.

Investigations in 2025 indicate a shift in delivery mechanisms, with attackers using fake reCAPTCHA pages hosted on legitimate cloud services to deceive users into executing malicious commands .

The use of developer-friendly platforms like OCI and Scaleway, targeting privileged users, raises concerns about potential lateral movement and deeper network compromise within enterprise environments.

Evolving Tactics of Lumma Stealer Campaigns

Since February 2025, threat actors have used Tigris Object Storage to host deceptive reCAPTCHA pages that prompt users to execute malicious PowerShell commands via the Windows Run dialog (Windows + R).

These commands, often obfuscated and copied to the clipboard, silently launch legitimate binaries like mshta.exe to fetch trojans disguised as benign files, such as "sports[.]mp4" from suspicious domains with TLDs like .shop.

By March, the campaign extended to OCI Object Storage, and by May 2025, Scaleway Object Storage was also exploited for hosting similar malicious content.

Analysis of Document Object Model (DOM) samples from these pages revealed Russian-language comments suggesting a possible connection to Russian-speaking attackers.

This exploitation of trusted infrastructure aids in evading initial detection and capitalizes on Scaleway’s relatively lower security visibility, allowing malicious content to persist longer.

Lumma Stealer campaigns have diversified their targets, evolving from gaming enthusiasts in 2024 to technically proficient users in 2025.

Security measures by Cato Networks, through their MDR service, have proactively blocked redirection attempts to these fake reCAPTCHA pages with high-confidence IPS rules.

Responses from affected cloud providers vary: Tigris confirmed the removal of reported malicious content, Scaleway eliminated the fake pages, and Oracle has yet to respond.

The ongoing evolution of Lumma Stealer tactics underscores the need for continuous behavioral analysis and contextual detection. Organizations must adopt advanced threat intelligence and prevention mechanisms to protect against these sophisticated campaigns.

Type Indicator Description

URL objectstorage[.]ap-seoul-1[.]oraclecloud[.]com/n/id0cu93izlqm/b/need-to-complete-this/o/dest[.]html Hosting malicious CAPTCHA

URL datastream-dist[.]s3[.]pl-waw[.]scw[.]cloud/pass-this-for-access-prism[.]html Hosting malicious CAPTCHA

URL amacys[.]shop/sports[.]mp4 Malicious HTA masqueraded as other file type

Based on reporting by GBHackers.