Ukraine’s cyber agency says attackers hijacked more than 100 legitimate websites to trick visitors into infecting their own Windows computers with Lunex Stealer. CERT-UA said the September campaign used fake Cloudflare verification pages that told users to copy and run a PowerShell command, which installed Lunex and in some cases the LunarAxe browser extension and NaiveMess component to steal passwords, cookies, authentication tokens, cryptocurrency wallet data, and provide persistent remote access. CERT-UA tracks the activity as UAC-0277.
Why it matters: People in Ukraine who visited compromised sites could have had passwords, browser sessions, and crypto wallets stolen without realizing it. Organizations and users should treat any request to paste commands into PowerShell or Run dialogs as suspicious, check for Lunex/LunarAxe compromise, and reset credentials from a clean device if exposure is suspected.
info@thehackernews.com (The Hacker News)
2026.10.07
98% relevant
This appears to be the same underlying event: a ClickFix-style campaign using fake Cloudflare checks on more than 100 compromised websites to deliver Lunex Stealer, adding another report on the same infection chain and scope.
2026.10.06
100% relevant
This article establishes a distinct tracked story around CERT-UA's disclosure of a specific ClickFix-to-Lunex malware campaign compromising more than 100 Ukrainian websites.
← Back to all stories