{"id":3409,"date":"2026-10-07T07:45:44","date_gmt":"2026-10-07T07:45:44","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3409"},"modified":"2026-10-07T07:45:44","modified_gmt":"2026-10-07T07:45:44","slug":"100-compromised-websites-use-fake-cloudflare-checks-to-deliver-lunexstealer","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3409","title":{"rendered":"100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 07, 2026<\/span><\/span>Malware \/ Web Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer<\/strong> (aka Psychedelic Stealer).<\/p>\n

The activity, which was observed by the agency in September 2026, has been attributed to a threat cluster dubbed UAC-0277. It did not disclose who the victims of the campaign were or if any systems were successfully compromised as a result of these attacks.<\/p>\n

\u00abWhen visiting such a site, users were shown a forged Cloudflare verification page that, under the pretext of confirming the visitor is human, prompted them to execute a command,\u00bb CERT-UA said<\/a> in an advisory. \u00abExecuting the command caused a malicious MSI package to be downloaded and installed from a remote server (the ClickFix technique).\u00bb<\/p>\n

The attacks also make use of the EtherHiding technique to retrieve the domain name of the resource from which the fake verification page is loaded, as well as the script’s operating mode, from a smart contract on the Polygon or Ethereum network.<\/p>\n

According to CERT-UA, there are three operating modes: 0 \u2013 inactive; 1 \u2013 passive tracking of visitors that includes gathering data about the website and the page from which the visitor arrived; and 2 \u2013 displaying the fake verification page.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

In Mode 2, the bogus verification page is shown only to Windows users who arrive at the site from search engine results and not more than twice in 12 hours. These ClickFix lures lead to the distribution of MSI packages that deliver LunexStealer.<\/p>\n

At least three different variants of the MSI packages have been discovered –<\/p>\n