100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

1. Executive summary

CERT-UA observed in September 2026 that more than 100 compromised websites were injected with malicious JavaScript that shows visitors a forged Cloudflare human-verification page and instructs them to run a command, which downloads and installs an MSI package delivering the LunexStealer infostealer (also tracked as Psychedelic Stealer). CERT-UA attributes the activity to a cluster it calls UAC-0277; that cluster has no MITRE ATT&CK profile in our reference data, so the attribution is unconfirmed. The lures are Windows-only, served from search-engine referrals, and capped at two displays per visitor in 12 hours, which keeps the campaign below the threshold most users would notice. For EMEA financial services the exposure is browser-session and credential theft on corporate endpoints, including the LUNARAXE extension that reads cookies, form entries and browsing history and can run arbitrary JavaScript in the victim's browser. No CVE is referenced in this item and no CISA KEV entry applies; the risk is operational, not patch-driven.

2. Regulatory framing

DORA Art. 17 is not listed as engaged here because the source does not describe a failure of the entity's own incident-management process; the process obligation is generic to any incident and does not change what a client must do because of this item. DORA Art. 28 to 30 and NIS2 Art. 21(2)(d) are not engaged: the compromised websites are third-party sites the victim visits, not ICT third-party providers under contract to the entity. UK NIS 2018 duties apply only where the entity is an OES or RDSP; the same confirmed-infection trigger governs.

3. Technical analysis & attack chain

The chain below is what CERT-UA describes. Steps 1 to 4 are the delivery path; steps 5 to 8 are the post-install behaviour of LunexStealer and its components.

1. A user reaches one of the 100+ compromised websites from a search-engine result. The injected JavaScript checks the visitor: Windows only, referred from a search engine, and not shown the lure more than twice in 12 hours.
2. The page renders a forged Cloudflare verification screen that tells the visitor to confirm they are human by executing a command. This is the ClickFix technique: the user runs the command themselves, so no exploit is needed.
3. The command downloads and installs a malicious MSI package from a remote server. The domain of that server, and the script's operating mode, are retrieved from a smart contract on the Polygon or Ethereum network (EtherHiding), so the infrastructure is not hard-coded in the injected JavaScript.
4. The MSI installs LunexStealer. CERT-UA has identified at least three MSI variants, described below.
5. LunexStealer installs a malicious browser extension called LUNARAXE, which presents itself as "Microsoft Office Word Editor".
6. LUNARAXE runs three modules. LUNARAXE.CORE handles C2 communication, receives and executes commands, and exfiltrates cookies, browsing history, bookmarks, details of installed extensions and intercepted credentials; it can also manage tabs, enable or disable extensions, serve notifications, run JavaScript on pages, display bogus overlays, and copy, write and execute files when NAIVEMESS is present. LUNARAXE.STEALER captures credentials entered into web forms and sends them to LUNARAXE.CORE together with the page URL. LUNARAXE.STRIP disables Content Security Policy protections on pages by stripping CSP headers.
7. The stealer deploys an auxiliary component called NAIVEMESS, installed according to a configuration received from the C2 server. NAIVEMESS gives LUNARAXE access to the Windows file system through a PowerShell-based Native Messaging Host. Its functions are listing drives, browsing directories, reading, creating and overwriting files, and executing them. Files are transferred in Base64-encoded chunks, and directories and file groups are pre-archived into ZIP.
8. NAIVEMESS does not hold its own C2 channel. Commands reach it through the extension.

The three MSI variants differ in how they get the stealer running and how they handle defences:

• Variant 1 installs LunexStealer directly on the system.
• Variant 2 attempts to bypass Windows User Account Control, configures Microsoft Defender exclusions, uses the legitimate but vulnerable AMD driver PDFWKRNL.sys to blind security software, and then retrieves and runs LunexStealer from a remote server.
• Variant 3 launches LunexStealer through DLL sideloading: the legitimate binary FnHotkeyUtility.exe loads a rogue DLL named spkvol.dll, which decrypts and executes the stealer.

The EtherHiding detail matters for defenders. Because the resource domain and the operating mode come from a smart contract, blocking the injected JavaScript's known domains does not stop the next stage; the script can be pointed at a new host without editing the compromised page. CERT-UA describes three operating modes: 0 is inactive, 1 is passive tracking that collects data about the website and the visitor's referrer, and 2 displays the fake verification page. Mode 1 means a site can be compromised and tracking visitors without any of them seeing a lure, so a clean-looking page is not evidence the site is clean.

Confidence caveats. The campaign scope, the UAC-0277 attribution, the operating modes, the MSI variants and the LUNARAXE and NAIVEMESS component descriptions all rest on CERT-UA's advisory as reported; the LUNARAXE extension and LunexStealer behaviour are additionally documented by Arctic Wolf Labs and Ontinue, so those parts are multi-sourced. CERT-UA did not disclose the victims or confirm that any system was successfully compromised, so the number of actual infections is unknown. UAC-0277 has no MITRE ATT&CK profile in our reference data; treat the attribution as unconfirmed and do not map it to a known actor. The source does not name the C2 infrastructure, the MSI download hosts, or any file hashes.

4. Mitigation & containment

P1 within 24 hours

• Block execution of MSI packages from user-writable and download directories where your environment does not need it. The delivery depends on the user running a command that fetches and installs an MSI; application control that denies msiexec from those paths breaks the chain at step 3.
• Hunt for the ClickFix pattern in endpoint telemetry: a browser process spawning cmd.exe or powershell.exe, followed by msiexec.exe with a remote URL or a file in %TEMP% or %USERPROFILE%\Downloads. The source does not give the exact command string, so build the rule on the parent-child relationship and the msiexec argument shape.
• Search for the two named binaries and the rogue DLL. FnHotkeyUtility.exe loading spkvol.dll is the Variant 3 sideload; if FnHotkeyUtility.exe is present on endpoints, verify the DLL beside it is the vendor's signed copy. Treat any spkvol.dll outside a known vendor path as malicious.
• Check for the AMD driver PDFWKRNL.sys. If it is present and not required by a known workload, remove it and investigate how it arrived. A legitimate signed driver used to blind security software will not be caught by signature checks alone.
• Audit Microsoft Defender exclusions. Variant 2 adds exclusions; any exclusion that was not deployed by your own change process should be removed and the endpoint treated as compromised.

P2 within 72 hours

• Enumerate browser extensions across managed endpoints and remove anything presenting as "Microsoft Office Word Editor" or otherwise not on your allowlist. LUNARAXE is a browser extension, so it survives endpoint cleanup that only removes the MSI payload.
• Check for a PowerShell-based Native Messaging Host registration. NAIVEMESS reaches the file system through one; native messaging host manifests live in the registry under the browser vendor keys and in the browser's NativeMessagingHosts directory. Any host manifest that points at a PowerShell script and was not deployed by your team is malicious.
• Reset credentials and invalidate sessions for any user with a confirmed infection. LUNARAXE.STEALER captures form entries and LUNARAXE.CORE exfiltrates cookies, so both passwords and live session tokens are in scope. Cookie theft means a password reset alone does not close the session; revoke tokens and force re-authentication.
• Review web proxy and DNS logs for the EtherHiding pattern: requests to public Polygon or Ethereum RPC endpoints from user endpoints. Workstations have no business calling blockchain RPC endpoints, so this is a high-signal detection even without knowing the contract address.

P3 within 7 days

• Add the fake Cloudflare verification page to user awareness material with the specific instruction: a real Cloudflare check never asks you to open a terminal or run a command. The ClickFix lure depends on the user not knowing that.
• Where you cannot enforce application control, restrict msiexec execution to administrators and to signed packages from approved sources.
• Re-test your incident classification and reporting path against a confirmed endpoint infostealer case, so the DORA Art. 18 decision and the Art. 19 timeline are exercised before a real event.

The source gives no vendor fix, no patch and no CVE, because there is no exploited software vulnerability in this chain. The controls that matter are application control, extension management, credential and session revocation, and user awareness.

5. Indicators of compromise

The source material contains no atomic network indicators, no file hashes, no C2 addresses and no registry keys. It names files and components, which are listed below as behavioural and artefact indicators rather than machine-pivotable network IOCs.

No atomic indicators of compromise available in the source material beyond the file and component names above. The source gives no hashes, domains, IP addresses or URLs, so no copyable indicator block is provided.

Behavioural indicators

The behavioural indicators rest on CERT-UA's description of the campaign; the LUNARAXE extension behaviour is corroborated by Arctic Wolf Labs and Ontinue. The RPC-endpoint and CSP-stripping observations are inferred from the described techniques and are not given as atomic indicators in the source; verify before enforcing.

6. Detection

The source gives distinctive artefacts: the two binary names, the rogue DLL name, the driver name, the extension display name, and the component names. The YARA rule below matches on those artefacts as they would appear in the malicious files or their metadata. It will not match the injected JavaScript on the compromised websites, because the source does not quote that script.

rule LunexStealer_Components_Oct2026
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-07"
        reference = "https://thehackernews.com/2026/10/100-compromised-websites-use-fake.html"
        description = "Matches artefacts named in CERT-UA reporting on LunexStealer, LUNARAXE and NAIVEMESS. Strings are component and file names, not network indicators."
    strings:
        $a = "spkvol.dll" ascii wide nocase
        $b = "FnHotkeyUtility.exe" ascii wide nocase
        $c = "PDFWKRNL.sys" ascii wide nocase
        $d = "LUNARAXE" ascii wide nocase
        $e = "NAIVEMESS" ascii wide nocase
        $f = "Microsoft Office Word Editor" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

The Sigma rule below targets the ClickFix delivery pattern and the extension and native-messaging behaviour. It uses process relationships rather than a command string, because the source does not provide the exact command.

title: ClickFix MSI Delivery and LunexStealer Component Activity
id: 7f3c1a92-4b6e-4d21-9c8a-2e5f0b7d1a44
status: experimental
description: Detects the ClickFix pattern where a browser spawns a shell that installs a remote MSI, and related LunexStealer component activity reported by CERT-UA.
author: Adverse Trace
date: 2026-10-07
references:

    - https://thehackernews.com/2026/10/100-compromised-websites-use-fake.html
logsource:
    category: process_creation
    product: windows
detection:
    selection_browser_parent:
        ParentImage|endswith:

            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
        Image|endswith:

            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_msi:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains:

            - 'http://'
            - 'https://'
            - '\Downloads\'
            - '\Temp\'
    selection_sideload:
        Image|endswith: '\FnHotkeyUtility.exe'
    condition: selection_browser_parent or selection_msi or selection_sideload
falsepositives:

    - Software deployment tools that launch msiexec from a browser context
    - Legitimate vendor software that ships FnHotkeyUtility.exe
level: high

Both rules use only artefacts named in the source. Tune the msiexec selection against your software deployment tooling before enabling at high severity.

7. Sources

• The Hacker News, "100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer", https://thehackernews.com/2026/10/100-compromised-websites-use-fake.html, 2026-10-07. Primary item; reports CERT-UA's advisory and cites Arctic Wolf Labs and Ontinue for the LUNARAXE extension and LunexStealer behaviour.
• CERT-UA advisory, referenced by the above but not linked in the source material. The original Ukrainian advisory was not retrieved for this note; the campaign scope, operating modes and MSI variant descriptions are taken from The Hacker News reporting of it.

8. Adverse Trace position

Adverse Trace assesses this as a medium-severity, high-relevance campaign for EMEA financial services clients. There is no CVE and no CISA KEV entry, so it will not appear in vulnerability-driven prioritisation, but the LUNARAXE extension and NAIVEMESS file-system component give an operator persistent browser-level access and credential and session theft that survives a simple endpoint cleanup. The attribution to UAC-0277 is unconfirmed: the cluster has no MITRE ATT&CK profile in our reference data, and CERT-UA has not named the victims or confirmed any successful compromise, so we do not attribute this to a known actor. The campaign detail is single-sourced to CERT-UA for the delivery chain and MSI variants, with the LUNARAXE extension corroborated by Arctic Wolf Labs and Ontinue; verify the file and component names against your own telemetry before enforcing blocks. We will monitor for CERT-UA's full advisory and for any published hashes, C2 domains or contract addresses, and will issue a follow-up if atomic indicators become available. Clients who confirm a LunexStealer infection should treat it as a credential and session compromise, not a malware removal, and should run the DORA Art. 18 classification before deciding on Art. 19 reporting.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.