Fake Cloudflare Pages Trick Users Into Installing LunexStealer via Compromised Sites
Written by AI from the linked story. Not reviewed by an editor. How this works
Over 100 legitimate websites were compromised with malicious JavaScript that redirects visitors to convincing fake Cloudflare verification pages, exploiting users' trust in a widely recognized security brand. Victims who interact with the fake prompt download MSI packages that silently install LunexStealer, capable of data exfiltration, security bypass, and deploying a rogue browser extension. This campaign highlights two compounding failures: website owners failing to detect and remediate malicious code injections, and end users lacking the awareness to distinguish legitimate CAPTCHA/verification flows from social engineering lures. The consequences are severe — credentials, session tokens, and sensitive browser data can be harvested at scale from unsuspecting users who believe they are completing a routine security check.
Tactical Insight
Immediate actions
- Audit all web properties for unauthorized JavaScript injections using integrity scanning tools or a Web Application Firewall (WAF).
- Train users to recognize that legitimate Cloudflare verification pages never prompt downloads of executable files (MSI, EXE, etc.).
- Block execution of unsigned or untrusted MSI packages via application whitelisting (e.g., AppLocker or Windows Defender Application Control).
Long-term improvements
- Implement Subresource Integrity (SRI) checks and Content Security Policy (CSP) headers on all web assets to prevent unauthorized script injection.
- Establish a regular cadence of website security scanning (at minimum weekly) to detect compromised files or injected payloads early.
- Enforce browser extension allow-listing policies across the organization to prevent installation of unauthorized or malicious extensions.
Detection measures
- Deploy endpoint detection and response (EDR) tooling configured to alert on suspicious MSI installations originating from browser processes.
- Monitor DNS and network traffic for connections to known LunexStealer/UAC-0277 command-and-control infrastructure using threat intelligence feeds.
- Integrate CERT-UA advisories and IOC feeds into your SIEM to enable real-time correlation against this active threat cluster.