Over 100 Compromised Websites Spread LunexStealer Through Fake Cloudflare Verification Pages

Cybersecurity researchers have uncovered a malware campaign involving more than 100 compromised websites that display fake Cloudflare verification pages to trick visitors into installing information-stealing malware.

Ukraine's Computer Emergency Response Team (CERT-UA) attributed the September 2026 activity to a threat cluster tracked as UAC-0277. The campaign distributes LunexStealer, also known as Psychedelic Stealer, using the ClickFix social-engineering technique.

How the Attack Works

Attackers inject malicious JavaScript into legitimate websites. When visitors access these compromised pages, they encounter a fake Cloudflare security verification screen.

Instead of completing a normal CAPTCHA, users are instructed to execute a command on their computers.

The command downloads and installs a malicious Windows Installer (MSI) package, initiating the malware infection.

Attack sequence:

Compromised Website → Fake Cloudflare Verification → ClickFix Instructions → Malicious MSI Download → LunexStealer Infection

The campaign also uses EtherHiding, a technique that retrieves attacker-controlled infrastructure information through blockchain smart contracts. This allows attackers to change delivery infrastructure without repeatedly modifying the compromised websites.

What Is LunexStealer?

LunexStealer, previously identified as Psychedelic Stealer, is information-stealing malware targeting Windows systems.

Its reported capabilities include:

• Stealing saved browser passwords and authentication data
• Collecting browser cookies and session tokens
• Targeting cryptocurrency-wallet information
• Gathering system information
• Establishing persistence through scheduled tasks
• Communicating with attacker-controlled infrastructure

Stolen session tokens may also enable account hijacking when additional security controls do not prevent their reuse.

Why Fake Cloudflare Pages Are Effective

Cloudflare verification screens are familiar to internet users, making them useful impersonation targets for cybercriminals.

Attackers exploit that familiarity by presenting malicious instructions as a routine security check.

Unlike a genuine Cloudflare challenge, a ClickFix page may instruct users to:

• Press Windows + R
• Paste a command into the Run dialog
• Execute PowerShell or another system utility
• Install software to complete verification

Legitimate CAPTCHA verification does not require users to execute operating-system commands.

More Than 100 Websites Compromised

CERT-UA identified over 100 websites containing malicious JavaScript associated with the campaign.

However, the agency did not disclose the identities of the victims or confirm how many visitors ultimately installed the malware.

Therefore, the discovery of 100 compromised websites should not be interpreted as evidence of 100 successful endpoint infections.

What Organizations Should Do

Security teams should prioritize the following defensive measures:

• Educate users about fake CAPTCHA and ClickFix attacks.
• Monitor suspicious msiexec.exe execution.
• Investigate unexpected PowerShell activity following browser sessions.
• Detect unauthorized scheduled-task creation.
• Review browser credential and session-token access.
• Monitor suspicious outbound connections.
• Use endpoint detection and response (EDR) tools to identify malware behavior.
• Keep websites, plugins and content management systems updated.

Website administrators should also inspect pages for unauthorized JavaScript injections and monitor changes to web content.

Security Takeaway

The campaign demonstrates how attackers can transform trusted websites into malware delivery platforms without necessarily exploiting vulnerabilities on visitors' devices.

By combining compromised websites, fake Cloudflare verification pages, ClickFix and blockchain-based infrastructure discovery, attackers create a convincing infection chain.

Organizations should reinforce user awareness and endpoint monitoring, particularly around commands executed from browser-based instructions.