Reported by 2 outlets
CERT-UA: 100+ websites compromised to spread Lunex Stealer via fake Cloudflare checks (UAC-0277)
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.22 / 0.6 · time to second source
- Recency
- × 0.05 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.1 / 10 = base × recency + community
Analysis
CERT-UA tracks UAC-0277, a campaign in which attackers compromised over 100 legitimate Ukrainian websites to distribute Lunex Stealer through ClickFix social-engineering traps. Victims are shown a fake Cloudflare verification page and tricked into running a PowerShell command that installs the stealer. The malware harvests passwords, tokens, and cryptocurrency wallets, and also deploys the LunarAxe browser extension to steal cookies, browse directories, and execute remote commands. CERT-UA links the operation to a relatively new malware-as-a-service platform; Ontinue previously documented similar activity targeting Ukrainian users in early September.
Timeline
-
original reporting
More than a hundred websites compromised to infect Ukrainian users with Lunex Stealer via fake Cloudflare check
linuxmint.hu · 5d ago · October 8th, 2026
More than a hundred legitimate websites have been compromised to trick Ukrainian users into infecting themselves with data-stealing malware, according to a fresh report from Ukraine's computer security incident response center, CERT-UA. In the campaign, discovered in September, attackers injected malicious code into the affected sites, and visitors were served a fake Cloudflare verification page. The page asked them to copy and run a command in Windows PowerShell to prove they were not a bot. Anyone who complied actually installed a stealer called Lunex, which harvests passwords, authentication tokens, and cryptocurrency wallet data, and also gives the attackers remote access to the machine. The method, known as ClickFix, is spreading: unsuspecting victims are manipulated into running malicious commands themselves. CERT-UA did not name the victims or say how many computers were infected; the affected sites included an online shop and a children's coloring page. In some cases Lunex also installs LunarAxe, a malicious extension for Chromium-based browsers disguised as "Microsoft Office Word Editor". The extension can steal cookies, browsing history, and credentials entered on websites, and gives attackers extensive control over the browser: managing tabs, running JavaScript on pages, taking screenshots, and changing proxy settings. Combined with a second component called NaiveMess, LunarAxe also reaches the computer's file system beyond the browser, letting attackers browse directories, read and overwrite files, and run programs on the already infected machine. CERT-UA has not yet tied the operation to a known hacker group and is tracking the activity under the identifier UAC-0277. The findings match early-September research by Swiss cybersecurity firm Ontinue, which documented similar Lunex activity targeting Ukrainian-speaking users. Ontinue assesses Lunex as a relatively new malware-as-a-service platform whose developers provide the infrastructure to other criminals for their own attacks; researchers believe the malware was written by a Russian-speaking developer or team.
via Mastodon https://linuxmint.hu/hir/2026/10/tobb-mint-szaz-weboldalt-torhettek-fel-ukran-felhasznalok-megfertozesere
-
update from insicurezzadigitale.com
UAC-0277: over 100 Ukrainian sites turned into ClickFix traps to distribute Lunex Stealer via smart contract
insicurezzadigitale.com · 4d ago · October 9th, 2026
CERT-UA discovered UAC-0277, a campaign in which over 100 Ukrainian websites were turned into ClickFix traps to distribute Lunex Stealer via a smart contract mechanism. The campaign uses compromised sites to deliver malware through deceptive user interaction. Organizations should monitor for ClickFix-style delivery patterns. via Mastodon https://insicurezzadigitale.com/uac-0277-oltre-100-siti-ucraini-trasformati-in-trappole-clickfix-per-distribuire-lunex-stealer-via-smart-contract/