Fake Cloudflare Checks on 100+ Compromised Websites Deliver LunexStealer
Summary
CERT-UA says UAC-0277 compromised more than 100 websites to show fake Cloudflare checks that trick visitors into running commands and installing LunexStealer, which can steal browser data and access files.
Key points
- CERT-UA observed the activity in September 2026 and attributed it to threat cluster UAC-0277; it did not identify the website victims or confirm successful system compromises.
- The compromised sites use fake Cloudflare verification pages to prompt visitors to run a command, triggering a malicious MSI download through the ClickFix technique.
- EtherHiding retrieves the fake page’s resource domain and operating mode from a smart contract on Polygon or Ethereum.
- The fake verification lure is shown only to Windows users arriving from search results, and no more than twice within 12 hours.
- LunexStealer can install the LUNARAXE browser extension, which steals cookies, browsing history, and credentials entered into web forms, and can remotely control the browser.
- The NAIVEMESS component gives LUNARAXE Windows file-system access, including the ability to list drives, read or modify files, and execute them.
- CERT-UA recommends restricting Run dialog and MSI use, monitoring msiexec.exe, blocking vulnerable drivers, and allowlisting browser extensions; Microsoft also recommends an ASR rule against abuse of vulnerable signed drivers.
Article Details
- Attack Vectors
- Malicious JavaScript injected into compromised websites displays a forged Cloudflare verification page to selected Windows visitors arriving from search engine results.
- The fake verification page prompts visitors to execute a command, which downloads and installs a malicious MSI package.
- LunexStealer installs the LUNARAXE browser extension, which masquerades as "Microsoft Office Word Editor" and steals cookies, browsing history, and credentials entered into web forms.
- A smart contract on Polygon or Ethereum provides the domain name for the resource hosting the fake verification page and the script's operating mode.
- Defensive Notes
- CERT-UA advises organizations to prohibit regular users from using the Windows Run dialog through group policies.
- Restrict MSI package installation by users without administrator rights and monitor for execution of msiexec.exe.
- Enable blocking of vulnerable drivers through Microsoft's vulnerable driver blocklist.
- Limit browser-extension installation to allowlisted extensions.
- Microsoft recommends enabling the Attack Surface Reduction rule "Block abuse of exploited vulnerable signed drivers."
MITRE ATT&CK
T1059.001 · PowerShellNAIVEMESS uses a PowerShell-based Native Messaging Host to access the Windows file system and execute files.T1105 · Ingress Tool TransferExecuting the prompted command downloads the malicious MSI package from a remote server.T1176 · Software ExtensionsLunexStealer installs the LUNARAXE browser extension, which steals browser data and can execute JavaScript on web pages.T1204.002 · Malicious FileThe fake verification page prompts users to execute a command that downloads and installs a malicious MSI package.T1539 · Steal Web Session CookieLUNARAXE steals cookies from the browser.
Threat Actors
Malware
LUNARAXEWolf Labs and Ontinue, LunexStealer is also designed to install a malicious browser extension called LUNARAXE. The extension masquerades as "Microsoft Office Word Editor" to steal cookies, browsing history, andLunexStealerthat have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer (aka Psychedelic Stealer).NAIVEMESSThe stealer also deploys an auxiliary component named NAIVEMESS that's installed based on a configuration received from the command-and-control (C2) server. Its primary responsibility is to provide LUNARAXE with accessPsychedelic Stealerwith malicious JavaScript to serve an information-stealing malware called LunexStealer (aka Psychedelic Stealer).
Vendors
Products
Cloudflare"When visiting such a site, users were shown a forged Cloudflare verification page that, under the pretext of confirming the visitor is human, prompted them to execute a command," CERT-UA said in an advisory. "ExecutingMicrosoft WindowsIn Mode 2, the bogus verification page is shown only to Windows users who arrive at the site from search engine results and not more than twice in 12 hours. These ClickFix lures lead to the distribution of MSI packages