CERT-UA reported that over 100 hacked websites were used to distribute LunexStealer malware through fake Cloudflare security checks. The attack employed the ClickFix technique, where victims were presented with a fraudulent page mimicking Cloudflare's standard bot verification process. The fake page instructed visitors to run a command supposedly to confirm they were not bots, but this command actually downloaded and installed the LunexStealer malware. The threat actor behind this campaign is tracked as UAC-0277.

Урядова команда реагування на комп’ютерні надзвичайні події України, яка функціонує в складі Державної служби спеціального зв’язку та захисту інформації України.

Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through ClickFix commands.

Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through ClickFix commands. The lure is the now-familiar ClickFix technique, dressed up as Cloudflare’s standard bot check. The fake page asks you to run a command, supposedly to confirm you’re not a bot, and that command quietly downloads and installs an […]

Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through ClickFix commands.

The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer (aka Psychedelic Stealer). The activity, which was observed by the agency in September 2026, has been attributed to a threat cluster dubbed UAC-0277. It did not disclose who the

ウクライナの コンピュータ緊急対応チーム(CERT-UA)は、2026年9月に100以上の改ざんされたWebサイトを確認しました。これらのサイトは、偽のCloudflare認証ページを通じてLUNEXSTEALERを配布していました。 同機関はこの活動をUAC-0277として追跡しています。攻撃者は正規のWebサイト

Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through ClickFix commands.

CERT-UA found 100+ compromised sites using ClickFix lures to distribute LunexStealer to Windows search visitors.

Earth Sirrush, een aan Rusland gelieerde groep die sinds ten minste 2022 actief is, richt zich op Oekraïense overheidsinstanties, defensieorganisaties, grenswachten en logistieke operatoren. De groep, eerder bekend als SHADOW-EARTH-065 en overlappend met de CERT-UA aanduiding UAC-0099, gebruikt geavanceerde technieken om haar doelen te bereiken. De aanvalsketen van Earth Sirrush begint met zorgvuldig gecreëerde phishingberichten, kwaadaardige archieven en documenten die legitieme instellingen nabootsen. Eerdere campagnes maakten gebruik van de WinRAR-kwetsbaarheid CVE-2023-38831. Recentere operaties combineren overtuigende downloadpagina's met verborgen payloads en softwarecomponenten die l...

Ukrainische IT-Sicherheitsexperten haben eine großflächig angelegte Cyberkampagne aufgedeckt, bei der manipulierte Internetauftritte zur Verbreitung von Spionagesoftware genutzt werden. Nach Angaben des Computer Emergency Response Team of Ukraine (CERT-UA) schleusten Angreifer bösartigen JavaScript-Code in über 100 legitime ukrainische Websites ein. Ziel des Angriffs war es, Besuchern eine fingierte Sicherheitsüberprüfung des Dienstleisters Cloudflare anzuzeigen und sie zur […] The post Über 100 ukrainische Websites: JavaScript verbreitet Datendieb LUNEXSTEALER appeared first on BornCity.

CERT-UA が、ClickFix を使用した 100 以上の侵害サイトを発見。Windows ユーザーを狙い LunexStealer を配信している。正規サイト訪問後に偽のセキュリティ警告が表示され、マルウェアダウンロードへ誘導される。

CERT-UA found 100+ compromised sites using ClickFix lures to distribute LunexStealer to Windows search visitors.

Ukraine’s Computer Emergency Response Team (CERT-UA) has discovered more than 100 compromised websites being used to distribute an information-stealing malware known as LunexStealer, also called Psychedelic Stealer.

Curate Feeds | Make Collections | Customize Email Briefs