[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fASiUmlsLYJvtfblYazPyEJ5OPEPPjd16SMw9RGikxXk":3},{"article":4,"iocs":48,"watch_terms":52,"solutions":53,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":30},"8cdd36ab-1342-4c05-8425-998cc701fb5e","100+ Ukrainian Websites Hacked to Install Lunex Stealer with ClickFix Lure","100-ukrainian-websites-hacked-to-install-lunex-stealer-with-clickfix-lure-65c40f","Over 100 hacked Ukrainian websites used fake Cloudflare checks to install Lunex Stealer and steal browser passwords, tokens and cryptocurrency wallets.","A cyberattack has compromised over 100 Ukrainian websites, leveraging fake Cloudflare security checks to distribute the Lunex Stealer malware. The malware is designed to steal sensitive information including browser passwords, session tokens, and cryptocurrency wallet details from infected systems.","100+ Ukrainian websites hacked to install Lunex Stealer via fake Cloudflare checks.","https:\u002F\u002Fhackread.com\u002Fukrainian-websites-hacked-lunex-stealer-clickfix\u002F",null,"2026-10-07T09:28:21+00:00","2026-10-07T10:00:23.120026+00:00",8,[17,20,23],{"name":18,"type":19},"Unknown","threat_actor",{"name":21,"type":22},"ClickFix Lure","campaign",{"name":24,"type":25},"Cloudflare","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":12,"name":28,"slug":29},"Malware","malware",[31,36,41,43],{"category":32},{"id":33,"icon":12,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":12,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":26,"icon":12,"name":28,"slug":29},{"category":44},{"id":45,"icon":12,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":29,"value":50,"context":51},"Lunex Stealer","Malware used in the attack to steal credentials and wallet information.",[24],{"controls":54,"vendors":138},[55,84,112],{"slug":56,"name":57,"problem":58,"products":59},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":85,"name":86,"problem":87,"products":88},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":106,"vendor_name":24,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"slug":113,"name":114,"problem":115,"products":116},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[117,124,132],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":113,"product_name":121,"url":122,"description":123},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":133,"product_name":134,"url":136,"description":137},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":154},"clickfix-lure-drives-lunex-stealer-across-100-ukrainian-sites","ClickFix Lure Drives Lunex Stealer Across 100+ Ukrainian Sites","Attackers compromised over 100 Ukrainian websites and injected fake Cloudflare CAPTCHA prompts — a 'ClickFix' social engineering tactic — that trick users into executing malicious commands, ultimately deploying the Lunex Stealer malware. This attack exploits user trust in familiar security UI patterns (like Cloudflare checks) to bypass technical defenses entirely. Once executed, Lunex Stealer harvests browser credentials, session tokens, and cryptocurrency wallet data, enabling account takeovers and financial theft. The mass compromise of legitimate websites also highlights weak server-side security postures and insufficient integrity monitoring. This matters because users on trusted sites have little reason to suspect malicious content, making social engineering via familiar UI elements especially dangerous.",[144,145,146,147,148,149,150,151,152,153],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 14: Security Awareness and Skills Training","CIS Control 16: Application Software Security","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SA-11: Developer Testing and Evaluation","NIST CSF DE.CM-4: Malicious Code Detection","OWASP Top 10 A05:2021 - Security Misconfiguration","GDPR Article 32: Security of Processing (for EU-adjacent data subjects)","NIST SP 800-184: Guide for Cybersecurity Event Recovery",{}]