Mass Website Compromise Campaign Delivers LunexStealer Through Fake Cloudflare Security Checks
Executive Summary
In September 2026, Ukraine's CERT-UA identified over 100 compromised websites injected with malicious JavaScript to distribute LunexStealer malware through fake Cloudflare verification pages. The UAC-0277 threat cluster used ClickFix techniques and EtherHiding methods to selectively target Windows users arriving from search engines, delivering MSI packages that install sophisticated information-stealing capabilities including the LUNARAXE browser extension and NAIVEMESS file system access component.
This campaign represents the growing sophistication of social engineering attacks that exploit trusted security interfaces like Cloudflare to bypass user suspicion and deliver advanced persistent threats.
Why This Matters Now
This incident highlights the escalating trend of attackers weaponizing trusted security brands and legitimate infrastructure to deliver advanced information stealers, making traditional user awareness training insufficient against increasingly sophisticated social engineering campaigns.
Attack Path Analysis
UAC-0277 compromised over 100 websites with malicious JavaScript that displayed fake Cloudflare verification pages using ClickFix technique. Victims executed commands downloading MSI packages containing LunexStealer, which bypassed UAC and security controls. The malware installed LUNARAXE browser extension for credential theft and NAIVEMESS for file system access. Command and control used smart contracts on blockchain networks for domain resolution. The attack enabled comprehensive data exfiltration including credentials, browser data, and file system access with potential business disruption.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers compromised 100+ websites by injecting malicious JavaScript that displayed fake Cloudflare verification pages to trick users into executing ClickFix commands that downloaded malicious MSI packages
Related CVEs
CVE-2024-6956
CVSS 7.2A vulnerability in AMD kernel driver PDFWKRNL.sys allows privilege escalation and security software bypass through exploitation of vulnerable signed driver components.
Affected Products:
AMD PDFWKRNL.sys Driver – < 1.0.0.5
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Drive-by Compromise
User Execution: Malicious File
System Binary Proxy Execution: Msiexec
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Impair Defenses: Disable or Modify Tools
Credentials from Password Stores: Credentials from Web Browsers
Browser Session Hijacking
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Security Framework
Control ID: 6.2.3
NYDFS 23 NYCRR 500 – Cybersecurity Program - Multi-Factor Authentication
Control ID: 500.02(g)
DORA – ICT Risk Management Framework
Control ID: Article 8
CISA ZTMM 2.0 – Centralized Identity Management
Control ID: Identity - Advanced
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21(2)(a)
GDPR – Security of Processing
Control ID: Article 32
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Banking/Mortgage
LunexStealer's credential harvesting and browser extension manipulation directly threatens online banking systems, compromising customer financial data and regulatory compliance requirements.
Health Care / Life Sciences
Information stealer malware poses severe HIPAA compliance risks through credential theft and browser-based attacks targeting patient portals and healthcare management systems.
E-Learning
Compromised websites serving fake Cloudflare checks particularly threaten educational platforms where users frequently encounter verification pages and download educational content.
Financial Services
Browser extension attacks enabling remote control and credential interception create critical risks for financial transactions and sensitive customer data protection systems.
Sources
- 100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealerhttps://thehackernews.com/2026/10/100-compromised-websites-use-fake.htmlVerified
- CERT-UA Advisory on LunexStealer Campaignhttps://cert.gov.ua/article/6319983Verified
- LuneX Stealer Abuses AMD Driver to Evade Detectionhttps://thehackernews.com/2026/09/lunex-stealer-abuses-amd-driver-to.htmlVerified
- Microsoft Vulnerable Driver Blocklist Guidancehttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rulesVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have significantly constrained the LunexStealer attack by limiting lateral movement between compromised systems and restricting unauthorized outbound communications. The segmented architecture would likely reduce the blast radius from 100+ compromised websites to isolated workload boundaries.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Zero Trust fabric policies would likely constrain the initial payload delivery by limiting cross-workload communication pathways and reducing the scope of JavaScript injection across multiple web properties through segmented application boundaries.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies would likely constrain privilege escalation attempts by limiting the scope of system-level access and reducing the ability to modify security configurations across segmented workload boundaries within the compromised environment.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely constrain lateral propagation by blocking unauthorized inter-workload communications and limiting the malware's ability to spread across segmented network boundaries within the compromised infrastructure.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility controls would likely constrain C2 communications by providing centralized monitoring of cross-cloud traffic patterns and limiting unauthorized blockchain-based domain resolution through comprehensive network flow analysis and policy enforcement.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policies would likely constrain data exfiltration by monitoring and limiting unauthorized outbound data transfers, reducing the volume of sensitive information that could be transmitted through controlled egress points and traffic inspection.
The segmented architecture would likely contain residual impact to isolated workload boundaries, significantly reducing the scope of credential theft and file system access compared to the original widespread compromise across multiple web properties.
Impact at a Glance
Affected Business Functions
- Web Services and E-commerce
- Customer Data Management
- Financial Transaction Processing
- Digital Marketing and SEO
Estimated downtime: 7 days
Estimated loss: $500,000
Credentials, cookies, browsing history, bookmarks, file system access, and sensitive user authentication data across 100+ compromised websites. Browser extensions enabled remote control and arbitrary JavaScript execution on victim systems.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Cloud Firewall (ACF) with URL filtering and egress controls to block malicious MSI downloads and C2 communication attempts
- • Deploy Inline IPS (Suricata) to detect and block known exploit patterns and malicious payload delivery from compromised websites
- • Enable Zero Trust Segmentation with least privilege policies to prevent lateral movement and limit browser extension installation privileges
- • Configure Egress Security & Policy Enforcement to block unauthorized outbound data transfers and monitor for suspicious Base64-encoded file transfers
- • Establish Multicloud Visibility & Control with centralized policy management to detect anomalous browser extension activities and blockchain-based C2 communications
