LunexStealer spread via fake Cloudflare checks on 100+ sites

CERT-UA, Ukraine’s national incident response team, has described a campaign that turned more than 100 legitimate websites into traps. According to the advisory, as reported by Security Affairs, in September 2026 CERT-UA found malicious JavaScript added to these sites: visitors were shown a fake Cloudflare check that, supposedly to confirm they were human, asked them to run a command (the ClickFix technique). The command downloaded and installed an MSI package that launched the LunexStealer infostealer. The campaign is tracked as UAC-0277; according to Insicurezza Digitale, CERT-UA has not linked it to a known group so far.

The lure: ClickFix with little noise

According to Insicurezza Digitale, the page asks the user to press Win+R and paste and run a PowerShell command. The injected script has three modes: off, visitor tracking only, and the full fake check. Both sources report that the attack only targets Windows users arriving from a search engine, at most twice in 12 hours for the same visitor: this makes the campaign harder to spot for anyone analysing traffic or scanning the sites.

Command and control on the blockchain

The fake page’s domain and the script settings are stored in a smart contract on Polygon or Ethereum, which the script queries every time it runs. The attackers can change the domain or switch the attack on and off without touching the compromised sites, and data on a public blockchain cannot be taken down with an abuse report.

Three installer variants

CERT-UA analysed three variants of the MSI package:

1. the first installs the stealer directly;
2. the second tries to bypass User Account Control (UAC), adds Microsoft Defender exclusions and loads a vulnerable AMD driver by exploiting CVE-2023-20598 (bring your own vulnerable driver, BYOVD), to blind security tools before the payload;
3. the third uses DLL side-loading: a legitimate executable loads a malicious library that decrypts and launches the stealer.

Insicurezza Digitale adds details from the analysis by the company Ontinue: UAC is bypassed through the CMSTPLUA COM object; the driver is PDFWKRNL.sys from AMD Radeon Software and is used to wipe the kernel’s security callbacks, so antivirus and EDR keep running but no longer see anything. Again according to Ontinue, neither HVCI nor the Microsoft Vulnerable Driver Blocklist blocks this driver variant, although its hash has been in the LOLDrivers project since March 2026: this claim comes from a single source.

LunexStealer and its components

According to CERT-UA, LunexStealer can also download and run programs, MSI packages, PowerShell scripts and commands. Depending on the configuration it receives, it can install LUNARAXE, a browser extension that shows up as “Microsoft Office Word Editor”: it steals cookies, history and credentials entered in web forms, and lets attackers control the browser remotely (JavaScript in pages, tab management and capture, proxy changes). With the PowerShell component NAIVEMESS, registered as a native messaging host, the extension also gains access to the file system.

Insicurezza Digitale, citing Ontinue, also reports that:

• LunexStealer is sold as malware-as-a-service, with 28 control panels in 13 countries compared with 6 in June 2026;
• the extension is injected by editing the browser’s Secure Preferences file, outside the store;
• persistence relies on a Run registry key and a hidden scheduled task called psychedelicloveUtils.

MITRE ATT&CK techniques

In our reading: Drive-by Compromise (T1189), Malicious Copy and Paste (T1204.004), Dead Drop Resolver (T1102.001), Msiexec (T1218.007), Bypass User Account Control (T1548.002), Exploitation for Privilege Escalation (T1068), Impair Defenses (T1562.001), Hijack Execution Flow (T1574), Browser Extensions (T1176), Steal Web Session Cookie (T1539), Scheduled Task (T1053.005) and Registry Run Keys (T1547.001).

Impact for European and Italian companies

The affected sites are Ukrainian, but the chain works on any Windows workstation and LunexStealer is resold to several operators. The target is browser sessions and credentials, which open email, cloud services and business applications, and the BYOVD shows that a running antivirus does not guarantee visibility. For NIS2 entities, vulnerability management, cyber hygiene and staff training are among the required measures; in healthcare, the theft of sessions to portals holding patient data has serious consequences.

What to do now

1. Inform your staff, as CERT-UA advises: a real check never asks you to open Run, Command Prompt or PowerShell to paste a command. If it happens, close the page, even on a familiar site.
2. Restrict the tools: CERT-UA suggests blocking Win+R via Group Policy, limiting who can install MSI packages and blocking known vulnerable drivers.
3. Check drivers: make sure PDFWKRNL.sys (CVE-2023-20598) is blocked in your policies, without relying only on automatic blocklist updates.
4. Hunt for traces: unusual scheduled tasks such as psychedelicloveUtils, unapproved native messaging hosts, “Microsoft Office Word Editor” extensions not from the store, new Microsoft Defender exclusions, msiexec started right after a command from the Run dialog.
5. Protect your own websites: check the integrity of plugins, themes and third-party scripts.
6. If you find an affected machine, isolate it and treat its browser sessions and credentials as compromised.

The full indicators are in the CERT-UA advisory.

How ARXDOME helps

ARX Sentry collects events and inventory from computers and servers, with the suspicious execution and persistence families and MITRE ATT&CK tactics in the SOC pages. With ARX Trace, analysts run hunts across multiple machines, for example for suspicious scheduled tasks. ARX Shield shows the protection status of every machine and lets you isolate it from the network; ARX Horizon lets you query threat intelligence sources for indicators of compromise.

Last updated: 9 October 2026