[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUkp8heW8WqhXj7KhleqbSKdW-6akYUrhmLBmIZy23KI":3},{"article":4,"iocs":41,"watch_terms":64,"solutions":65,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"fb844b81-3876-4d44-ae04-665123c043df","100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer","100-compromised-websites-use-fake-cloudflare-checks-to-deliver-lunexstealer-3836fc","The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer (aka Psychedelic Stealer). The activity, which was observed by the agency in September 2026, has been attributed to a threat cluster dubbed UAC-0277. It did not disclose who the","CERT-UA has identified over 100 websites compromised with malicious JavaScript to distribute LunexStealer, also known as Psychedelic Stealer. The threat cluster UAC-0277 is behind this campaign, which uses fake Cloudflare verification pages to trick users into downloading MSI packages. These packages can install the stealer, bypass security measures, and even deploy a malicious browser extension called LUNARAXE.","100+ websites compromised to deliver LunexStealer via fake Cloudflare checks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002F100-compromised-websites-use-fake.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj4fqqLhgtSTncznc3k2vTS6LJlp8_v3RMx7LaYawiUYEMDuhQ1pOdqrYqlFeyAG5TPBmEnbkLI8vu43GMDxPvaZX6kABd1zQGpIAbVpD2pwtl5v4TohuwbBjlz4dMcjYUv11ogWwPoMoOFJn0aHmxX46xc5Y3ocuxOrg7ix9RrzPzfHtjlW2rAElAV-9-p\u002Fs1600\u002Fcf-malware.jpg","2026-10-07T06:57:54+00:00","2026-10-07T08:00:27.7417+00:00",8,[17,20],{"name":18,"type":19},"UAC-0277","threat_actor",{"name":21,"type":22},"Cloudflare","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42,45,48,51,54,58,61],{"type":27,"value":43,"context":44},"LunexStealer","Information-stealing malware distributed via compromised websites.",{"type":27,"value":46,"context":47},"Psychedelic Stealer","Alternative name for LunexStealer.",{"type":27,"value":49,"context":50},"LUNARAXE","Malicious browser extension installed by LunexStealer.",{"type":27,"value":52,"context":53},"NAIVEMESS","Auxiliary component for LUNARAXE to access the Windows file system.",{"type":55,"value":56,"context":57},"mitre_attack","T1059.001","PowerShell usage by NAIVEMESS for file system access.",{"type":55,"value":59,"context":60},"T1553.005","AMD driver usage to blind security software (Variant 2).",{"type":55,"value":62,"context":63},"T1574.002","DLL sideloading using legitimate binaries (Variant 3).",[21],{"controls":66,"vendors":153},[67,96,124],{"slug":68,"name":69,"problem":70,"products":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":97,"name":98,"problem":99,"products":100},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"vendor_slug":118,"vendor_name":21,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"slug":125,"name":126,"problem":127,"products":128},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[],{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":170},"fake-cloudflare-pages-trick-users-into-installing-lunexstealer-via-compromised-sites","Fake Cloudflare Pages Trick Users Into Installing LunexStealer via Compromised Sites","Over 100 legitimate websites were compromised with malicious JavaScript that redirects visitors to convincing fake Cloudflare verification pages, exploiting users' trust in a widely recognized security brand. Victims who interact with the fake prompt download MSI packages that silently install LunexStealer, capable of data exfiltration, security bypass, and deploying a rogue browser extension. This campaign highlights two compounding failures: website owners failing to detect and remediate malicious code injections, and end users lacking the awareness to distinguish legitimate CAPTCHA\u002Fverification flows from social engineering lures. The consequences are severe — credentials, session tokens, and sensitive browser data can be harvested at scale from unsuspecting users who believe they are completing a routine security check.",[159,160,161,162,163,164,165,166,167,168,169],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-4: Acquisition Process (supply chain integrity)","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 SC-18: Mobile Code","OWASP A08:2021 – Software and Data Integrity Failures","GDPR Article 32: Security of Processing (for site owners handling EU user data)","ITIL: Incident Management – Detection and Registration",{}]