Fake Cloudflare Checks on 100+ Compromised Websites Deliver LunexStealer

Ukraine’s CERT-UA identified more than 100 legitimate websites compromised to distribute LunexStealer, also known as Psychedelic Stealer, in a campaign observed in September 2026. Tracked as UAC-0277, the activity injects JavaScript that displays fake Cloudflare verification pages and uses ClickFix social engineering to persuade visitors to execute PowerShell commands that download and install malicious MSI packages. The campaign uses EtherHiding to retrieve delivery configuration from blockchain smart contracts, while installer variants employ direct installation, vulnerable-driver abuse, or DLL sideloading. CERT-UA has not attributed the campaign to a known hacking group, identified victims, or confirmed how many endpoints were successfully infected.

LunexStealer steals credentials, authentication tokens, and cryptocurrency wallet data, and can deploy the LUNARAXE browser extension to steal browser information and control browsing activity. An optional NAIVEMESS component enables file-system access and program execution. Separate Ontinue research describes Lunex as a malware-as-a-service platform developed by Russian-speaking actors and used by multiple independent operators, with browser components capable of retaining access after the main executable is removed. CERT-UA recommends restricting user-driven command execution, MSI installation, vulnerable drivers, and browser extensions; remediation should also check for malicious browser components rather than treating removal of the main malware executable as sufficient.