CERT-UA: 100+ Hacked Sites Push LunexStealer via Fake Cloudflare Check

Ukraine's Computer Emergency Response Team (CERT-UA) has reported more than a hundred compromised websites injected with malicious JavaScript that distributes the LunexStealer information stealer (also known as Psychedelic Stealer). The activity was observed in September 2026 and attributed to a threat cluster tracked as UAC-0277. The agency did not disclose who the victims were or whether any systems were successfully compromised.

A fake captcha instead of a robot check

Visitors to an infected site were shown a forged Cloudflare verification page. Under the pretext of confirming they were human, they were prompted to execute a command — the classic ClickFix trick. The result was the download and installation of a malicious MSI package from a remote server.

The address of the resource serving the fake page, along with the script's operating mode, is hidden in a smart contract on the Polygon or Ethereum network — the EtherHiding technique. Three modes exist: inactive, passive tracking of visitors, and the actual display of the fake check. In the last mode the page is shown only to Windows users arriving from search results, and no more than twice in 12 hours.

Three installer variants

CERT-UA identified at least three kinds of MSI packages. The first simply installs LunexStealer. The second tries to bypass User Account Control, adds Microsoft Defender exclusions and abuses a legitimate-but-vulnerable AMD driver (PDFWKRNL.sys) to blind security software. The third launches the stealer via DLL sideloading: the legitimate FnHotkeyUtility.exe loads a rogue spkvol.dll.

A parasitic browser extension

LunexStealer installs a malicious extension called LUNARAXE, masquerading as "Microsoft Office Word Editor." It steals cookies, history and credentials typed into web forms, and lets the operator remotely control the browser and run arbitrary JavaScript. A module named LUNARAXE.STRIP removes Content Security Policy headers, stripping away page protections.

Alongside the extension comes NAIVEMESS — a PowerShell-based Native Messaging Host granting file-system access: reading, creating, overwriting and executing files, transferred in Base64 chunks and bundled into ZIP archives.

CERT-UA's advice

Organizations are urged to bar ordinary users from the Windows Run dialog, restrict MSI installation without admin rights, monitor for msiexec.exe execution, enable Microsoft's vulnerable driver blocklist, and allow only approved browser extensions. Microsoft also recommends enabling the ASR rule that blocks abuse of exploited vulnerable signed drivers.

Source: The Hacker News