100+ Compromised Websites Use Fake Cloudflare Checks to Deliver Lunex Stealer
Summary: CERT-UA identified more than 100 compromised websites injected with malicious JavaScript to deliver an information stealer called LunexStealer, observed in September 2026 and attributed to a cluster dubbed UAC-0277. Visitors were shown a forged Cloudflare verification page that prompted them to execute a command, which downloaded and installed a malicious MSI package from a remote server using the ClickFix technique, with the page's domain and operating mode retrieved from a smart contract on the Polygon or Ethereum network via EtherHiding.
Why it matters: The fake verification page is shown only to Windows users arriving from search engine results and no more than twice in 12 hours, so most visitors - and most automated scanners - will never see the lure. The payload also installs a browser extension posing as "Microsoft Office Word Editor" that steals cookies and credentials and lets the operator run arbitrary JavaScript, with a PowerShell-based component giving it file-system access.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026