100+ Ukrainian Websites Hacked to Install Lunex Stealer with ClickFix Lure
100+ Ukrainian websites hacked to install Lunex Stealer via fake Cloudflare checks.
A cyberattack has compromised over 100 Ukrainian websites, leveraging fake Cloudflare security checks to distribute the Lunex Stealer malware. The malware is designed to steal sensitive information including browser passwords, session tokens, and cryptocurrency wallet details from infected systems.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cloudflare?
Get an email when a new story names Cloudflare, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers compromised over 100 Ukrainian websites and injected fake Cloudflare CAPTCHA prompts — a 'ClickFix' social engineering tactic — that trick users into executing malicious commands, ultimately deploying the Lunex Stealer malware. This attack exploits user trust in familiar security UI patterns (like Cloudflare checks) to bypass technical defenses entirely. Once executed, Lunex Stealer harvests browser credentials, session tokens, and cryptocurrency wallet data, enabling account takeovers and financial theft. The mass compromise of legitimate websites also highlights weak server-side security postures and insufficient integrity monitoring. This matters because users on trusted sites have little reason to suspect malicious content, making social engineering via familiar UI elements especially dangerous.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Lunex Stealer