[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8t5UfmKHryDgFhanB1-UcwTOcwJT_N-fmj_WdQumj58":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"99f7fbf2-df0f-4740-a39c-382c6bc84104","fake-cloudflare-pages-trick-users-into-installing-lunexstealer-via-compromised-sites","fb844b81-3876-4d44-ae04-665123c043df","Fake Cloudflare Pages Trick Users Into Installing LunexStealer via Compromised Sites","Over 100 legitimate websites were compromised with malicious JavaScript that redirects visitors to convincing fake Cloudflare verification pages, exploiting users' trust in a widely recognized security brand. Victims who interact with the fake prompt download MSI packages that silently install LunexStealer, capable of data exfiltration, security bypass, and deploying a rogue browser extension. This campaign highlights two compounding failures: website owners failing to detect and remediate malicious code injections, and end users lacking the awareness to distinguish legitimate CAPTCHA\u002Fverification flows from social engineering lures. The consequences are severe — credentials, session tokens, and sensitive browser data can be harvested at scale from unsuspecting users who believe they are completing a routine security check.","**Immediate actions:**\n- Audit all web properties for unauthorized JavaScript injections using integrity scanning tools or a Web Application Firewall (WAF).\n- Train users to recognize that legitimate Cloudflare verification pages never prompt downloads of executable files (MSI, EXE, etc.).\n- Block execution of unsigned or untrusted MSI packages via application whitelisting (e.g., AppLocker or Windows Defender Application Control).\n\n**Long-term improvements:**\n- Implement Subresource Integrity (SRI) checks and Content Security Policy (CSP) headers on all web assets to prevent unauthorized script injection.\n- Establish a regular cadence of website security scanning (at minimum weekly) to detect compromised files or injected payloads early.\n- Enforce browser extension allow-listing policies across the organization to prevent installation of unauthorized or malicious extensions.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) tooling configured to alert on suspicious MSI installations originating from browser processes.\n- Monitor DNS and network traffic for connections to known LunexStealer\u002FUAC-0277 command-and-control infrastructure using threat intelligence feeds.\n- Integrate CERT-UA advisories and IOC feeds into your SIEM to enable real-time correlation against this active threat cluster.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-4: Acquisition Process (supply chain integrity)","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 SC-18: Mobile Code","OWASP A08:2021 – Software and Data Integrity Failures","GDPR Article 32: Security of Processing (for site owners handling EU user data)","ITIL: Incident Management – Detection and Registration",{},"published","2026-10-07T08:20:36.876828+00:00","2026-10-07T08:20:36.6+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002F100-compromised-websites-use-fake.html","100-compromised-websites-use-fake-cloudflare-checks-to-deliver-lunexstealer-3836fc","100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":45,"name":46,"slug":47,"description":48,"color":49},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[52,56,60],{"slug":53,"name":54,"problem":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":57,"name":58,"problem":59},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":61,"name":62,"problem":63},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]