Cybersecurity
CERT-UA found fake Cloudflare checks delivering LunexStealer
CERT-UA said more than 100 compromised websites were serving LunexStealer through forged Cloudflare checks, MSI download chains and browser-extension components, and it linked the activity to UAC-0277.
- CERT-UA said it found more than 100 compromised websites carrying malicious JavaScript that delivered LunexStealer in September 2026.
- The agency attributed the activity to a cluster it called UAC-0277 and said it did not identify the victims or confirm successful compromise.
- A forged Cloudflare verification page led users to run a command that downloaded a malicious MSI package from a remote server.
- CERT-UA said three MSI variants were found, and Arctic Wolf Labs and Ontinue had previously documented the LUNARAXE browser extension.
- CERT-UA and Microsoft both published defensive guidance, including monitoring msiexec.exe and enabling Microsoft's vulnerable driver blocklist or related ASR rule.
CERT-UA said it had found more than 100 compromised websites carrying malicious JavaScript that served LunexStealer, also called Psychedelic Stealer. It said the activity was seen in September 2026 and linked it to a cluster it named UAC-0277.
The agency said visitors were shown a forged Cloudflare verification page that prompted them to run a command under the claim that it was checking whether they were human. Running the command caused a malicious MSI package to be downloaded from a remote server.
CERT-UA said the attackers also used EtherHiding to fetch the domain name for the fake page and the page's operating mode from a smart contract on Polygon or Ethereum. It said mode 2 showed the bogus page only to Windows users who arrived from search results and were not shown it more than twice in 12 hours.
The agency said it had found three MSI variants. One installed LunexStealer directly, one tried to bypass UAC, set Microsoft Defender exclusions and use the vulnerable AMD driver PDFWKRNL.sys, and one used DLL sideloading through FnHotkeyUtility.exe and spkvol.dll.
CERT-UA said LunexStealer also installed the LUNARAXE browser extension and an auxiliary component named NAIVEMESS. Arctic Wolf Labs and Ontinue had documented LUNARAXE as a tool for stealing cookies, browsing history and form-entered credentials, while CERT-UA advised several mitigations and Microsoft recommended its ASR rule for blocking abused vulnerable signed drivers.
Named in this story
Companies
- Cloudflare
- was impersonated by a fake verification page
- AMD
- made the vulnerable driver used in one variant
- Microsoft
- recommended enabling an attack surface reduction rule
Organisations
- Computer Emergency Response Team of Ukraine
- identified more than 100 compromised websites and issued the advisory
- UAC-0277
- was the threat cluster named by CERT-UA
- Arctic Wolf Labs
- helped document the extension's behaviour
- Ontinue
- helped document the extension's behaviour
Products and systems
- LunexStealer
- was the information-stealing malware delivered through the campaign
- Psychedelic Stealer
- was given as an alternative name for LunexStealer
- Polygon
- was one of the networks holding the smart contract used in the attack
- Ethereum
- was one of the networks holding the smart contract used in the attack
- Windows
- was the operating system targeted by one delivery mode and the UAC bypass
- Microsoft Defender
- had exclusions configured by one MSI variant
- PDFWKRNL.sys
- was the vulnerable AMD driver used to blind security software
- FnHotkeyUtility.exe
- was used to load a rogue DLL in one variant
- spkvol.dll
- was the rogue DLL that decrypted and ran the stealer
- LUNARAXE
- was the malicious browser extension installed by LunexStealer
- NAIVEMESS
- was an auxiliary component that gave the extension file-system access
- msiexec.exe
- was a process CERT-UA advised organisations to monitor
How the source tells it
The piece read as a plain incident report and defensive advisory, with little overt emotional framing.
No emotive framing was found in the original.