100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
100+ websites compromised to deliver LunexStealer via fake Cloudflare checks.
CERT-UA has identified over 100 websites compromised with malicious JavaScript to distribute LunexStealer, also known as Psychedelic Stealer. The threat cluster UAC-0277 is behind this campaign, which uses fake Cloudflare verification pages to trick users into downloading MSI packages. These packages can install the stealer, bypass security measures, and even deploy a malicious browser extension called LUNARAXE.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cloudflare?
Get an email when a new story names Cloudflare, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonOver 100 legitimate websites were compromised with malicious JavaScript that redirects visitors to convincing fake Cloudflare verification pages, exploiting users' trust in a widely recognized security brand. Victims who interact with the fake prompt download MSI packages that silently install LunexStealer, capable of data exfiltration, security bypass, and deploying a rogue browser extension. This campaign highlights two compounding failures: website owners failing to detect and remediate malicious code injections, and end users lacking the awareness to distinguish legitimate CAPTCHA/verification flows from social engineering lures. The consequences are severe — credentials, session tokens, and sensitive browser data can be harvested at scale from unsuspecting users who believe they are completing a routine security check.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — LunexStealer
- malware — Psychedelic Stealer
- malware — LUNARAXE
- malware — NAIVEMESS
- mitre_attack — T1059.001
- mitre_attack — T1553.005
- mitre_attack — T1574.002