Lumma Stealer campaigns now abuse legitimate cloud platforms to host fake CAPTCHA pages that trick privileged users into running malicious commands. This session will reveal how trusted clouds are weaponized, why high-access accounts are prime targets, and what defenders must do to spot and stop these attacks.