Fake Cloudflare checks on more than 100 hacked sites trick Ukrainians into installing Lunex Stealer
CERT-UA says attackers planted fake Cloudflare checks on more than 100 legitimate websites to get visitors to install Lunex Stealer themselves. Ontinue says its browser components can keep file access after the stealer is deleted, so cleanup has to reach the browsers.
The Watch · Security desk
What happened
- CERT-UA found the campaign in September, tracks it as UAC-0277 and has not tied it to any known hacking group.
- Lunex steals passwords, authentication tokens and cryptocurrency wallet data, and gives the attacker remote access to the infected computer.
- In some infections Lunex adds LunarAxe, a Chromium extension posing as "Microsoft Office Word Editor" that steals cookies, browsing history and typed credentials.
- Swiss firm Ontinue calls Lunex a malware-as-a-service platform from a Russian-speaking developer or team, sold to multiple independent criminal operators.
- Ontinue found 28 Lunex operator panels hosted across 13 countries.
Why it matters
- Who's exposed exposure The lure runs on hacked legitimate sites, so visitors get no warning from a site's reputation, and any compromised page can serve the fake check.
- Who has to decide decision The chain needs the visitor to paste and run a PowerShell command, so on managed machines whether ordinary users can run PowerShell decides whether this lure gets through.
- What it limits constraint With Lunex rented to several crews, taking down UAC-0277's sites or panels would leave the platform working for its other customers.
Next story · Security · Sep 24
Compromised Ukrainian business sites are serving a ClickFix lure that installs through msiexecConfirmed3 publishers
The 100-site count measures delivery points. CERT-UA did not identify the victims or say how many computers were infected [10]. The compromised sites it named are an online store and a site offering coloring pages for children [6]. The Record describes the targets as Ukrainian users [1].
On the victim's machine the attack needs one action from the user. The fake Cloudflare page tells the visitor to copy a command and run it in PowerShell, the Windows command-line tool, as proof of being human [2]. The Record calls this technique, ClickFix, an increasingly common way of getting users to infect their own devices [9].
The browser components make removal harder. LunarAxe lets the attacker manipulate tabs, run JavaScript on webpages, take screenshots and change proxy settings [5]. Paired with a second component, NaiveMess, it reaches the file system: the attacker can browse directories, read and overwrite files and execute programs [7]. According to Ontinue, that access can remain after the main Lunex executable is removed [13]. A responder who deletes the binary still has to check the extensions in every Chromium browser on the host, including the one LunarAxe installs [18]. Ontinue counts seven targeted browsers: Chrome, Edge, Brave, Yandex Browser, Opera, Opera GX and Vivaldi [12].
CERT-UA's report follows Ontinue's research, published earlier in September, on similar Lunex activity aimed at Ukrainian-speaking users [11]. Ontinue says the platform still appears to be under active development and is being used for credential theft and for phishing that impersonates legitimate brands [15]. If Ontinue is right that Lunex is sold to independent operators, the 100-site campaign is one crew's use of a kit that others also run [19]. The control panel uses Russian as its default language and carries many Russian-language interface elements, according to the researchers [17].
What to watch
- CERT-UA publishing an infection count or naming affected organisations, to show how many of the 100-plus sites produced compromised machines.
- Any link between UAC-0277 and one of the 28 Lunex operator panels Ontinue found, or an attribution to a known group.
- Lunex ClickFix lures turning up on compromised sites aimed at users outside Ukraine, given panels hosted in 13 countries.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives25
- Confidence70
Perspective Coverage
3 publishers- Builder
- Builder 30%
- Operator
- Operator 62%
- Investor
- Investor 8%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Hackers compromised more than 100 websites to infect Ukrainian users with information-stealing malware.
- [2]
CERT-UA said attackers injected malicious code into legitimate websites; visitors were shown a fake Cloudflare verification page that told them to copy and run a command in PowerShell, a Windows command-line tool, to prove they were human.
- [3]
Following the instructions downloaded and installed Lunex Stealer, malware that can steal passwords, authentication tokens and cryptocurrency wallet data, and give attackers remote access to infected computers.
- [4]
In some cases Lunex installs a malicious extension for Chromium-based browsers called LunarAxe, disguised as Microsoft Office Word Editor, which can steal cookies, browsing history and credentials entered into websites.
- [5]
LunarAxe gives attackers extensive control over a victim's browser, allowing them to manipulate tabs, run JavaScript on webpages, take screenshots and change proxy settings.
- [6]
Among the compromised sites were an online store and a website offering coloring pages for children.
- [7]
Combined with another malicious component called NaiveMess, LunarAxe can access the computer's file system; attackers can browse directories, read and overwrite files and execute programs.
- [8]
CERT-UA discovered the campaign in September, has not attributed it to a known hacking group, and is tracking the activity as UAC-0277.
- [9]
The technique of asking victims to copy and run malicious commands, known as ClickFix, has become an increasingly common way of tricking users into infecting their own devices.
- [10]
CERT-UA did not identify the victims of the campaign or say how many computers were infected.
- [11]
Swiss cybersecurity company Ontinue published research earlier in September documenting similar Lunex activity targeting Ukrainian-speaking users.
- [12]
Ontinue found that Lunex targets seven Chromium-based browsers: Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX and Vivaldi.
- [13]
According to Ontinue, the browser components' access to a victim's files can remain even if the main Lunex executable is removed from the computer.
- [14]
Ontinue described Lunex as a relatively new malware-as-a-service platform developed by a Russian-speaking developer or team and sold to multiple independent cybercriminal operators.
- [15]
Ontinue said the platform still appears to be under active development and is being used for credential theft and phishing campaigns impersonating legitimate brands.
- [16]
Researchers found 28 Lunex operator panels hosted across 13 countries.
- [17]
The Lunex control panel uses Russian as its default language and contains numerous Russian-language interface elements.
- [18]
Because file access through the browser components can outlast removal of the Lunex executable, cleaning a host requires checking extensions in each Chromium browser Lunex targets, including for LunarAxe.
- [19]
If Lunex is sold to multiple independent operators, the UAC-0277 campaign is one operator's use of a platform other operators also run, and disrupting it leaves the platform available to them.
Sources
3 independent publishers whose own reporting we read for this story.
- securityaffairs.comCERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware
1 article · October 7, 2026
- thehackernews.com100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
1 article · October 6, 2026
- therecord.mediaClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware
1 article · October 6, 2026
Topics and entities
Topics
Entities
- PowerShell
- Cloudflare
- Arctic Wolf Labs
- CERT-UA