LUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome Extension

LUNEXSTEALER distributes through more than 100 compromised websites that inject malicious JavaScript delivering a fake Cloudflare verification prompt. Once executed, the Windows infostealer installs the LUNARAXE browser extension, which masquerades inside Chromium-based browsers as "Microsoft Office Word Editor". The extension does not just harvest cookies, browsing history, and form-entered credentials; it also grants operators the ability to execute arbitrary JavaScript within pages, manipulate browser behavior, and run remote commands. CERT-UA links the delivery infrastructure to fake captcha pages on over 100 Ukrainian sites serving LunexStealer, also tracked as Psychedelic Stealer.

This is not a passive credential logger. Remote JavaScript execution inside an authenticated browser session turns the victim's own session cookies and saved credentials into a live proxy for the attacker, bypassing many multi-factor controls that only verify at login time rather than continuously. With over 100 compromised delivery sites, exposure spans any user who completed the fake verification flow, not a targeted enterprise population. The dual theft-plus-control design explains why this story outranks routine infostealer reports: most stealers exfiltrate and exit; LUNARAXE keeps a persistent remote handle inside the browser.

Defenders should hunt for the LUNARAXE extension label, inspect Chromium profiles for unrecognized extensions named "Microsoft Office Word Editor", and review endpoint telemetry for the LunexStealer binary. Block the delivery domains referenced in CERT-UA reporting and scan for fake Cloudflare checkpoint scripts embedded in legitimate site templates. Since no patched version or vendor advisory exists for the extension mechanism itself, the primary remediation is removal of the malicious extension paired with full credential rotation for any account accessed from an infected host.

Watch for expanded CERT-UA disclosure on additional delivery domains or a researcher analysis of the LUNARAXE command protocol. If active exploitation telemetry from GreyNoise-style sensors shows broader geographic spread beyond Ukrainian sites, that would shift this from a regional campaign to a global browser-control threat requiring wider blocking rules.