LUNARAXE (Malware): news timeline & CVEs

Hackers Compromise 100+ Websites With Fake Cloudflare Checks to Spread LUNEXSTEALER

Attackers compromised over 100 sites with fake Cloudflare checks to install Windows infostealer LUNEXSTEALER.

CERT-UA, tracking the activity as UAC-0277, said attackers compromised more than 100 websites in September 2026 and used fake Cloudflare verification pages to spread the Windows malware LUNEXSTEALER. A ClickFix prompt told selected Windows visitors arriving from search engines to run a command that installed a remote MSI. Campaign mode and domains were retrieved from smart contracts on Polygon or Ethereum. The stealer collects browser passwords, tokens, wallet data, and system information, can install the LUNARAXE Chromium extension and NAIVEMESS PowerShell component, and one loader attempts UAC bypass, Defender exclusions, and abuse of AMD driver flaw CVE-2023-20598.

Cyber Security NewsOct 7, 13:28 UTC · 1d agoMalware in the wild 5 sources CVE-2023-205981

CERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware

CERT-UA says over 100 hacked sites used fake Cloudflare checks to install LunexStealer via ClickFix.

In September 2026, CERT-UA found more than 100 compromised websites showing fake Cloudflare checks that told Windows visitors to run a command. The command downloaded an MSI that installed LunexStealer, which can run executables, MSI packages, PowerShell, and raw commands. Campaign settings were stored in Polygon or Ethereum smart contracts so operators could change domains or disable the lure remotely. One variant bypassed UAC, added Microsoft Defender exclusions, and abused CVE-2023-20598 via a vulnerable AMD driver; another used DLL side-loading. The optional LUNARAXE extension, labeled Microsoft Office Word Editor, steals cookies, history, and form data and can control the browser, while NAIVEMESS adds file-system access.

Security AffairsOct 7, 13:22 UTC · 1d agoMalware in the wild 5 sources CVE-2023-205981

LUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome Extension

CERT-UA reports LUNEXSTEALER installs LUNARAXE for remote Chromium control after fake Cloudflare prompts.

CERT-UA tracks UAC-0277, a campaign using more than 100 compromised websites to distribute LUNEXSTEALER, a Windows infostealer. Fake Cloudflare checks tell Windows visitors to run a command that installs a malicious MSI, while delivery settings are read from Polygon or Ethereum smart contracts. The LUNARAXE extension, disguised as Microsoft Office Word Editor, can execute JavaScript, manipulate tabs, capture snapshots, change proxy settings, and steal cookies, history, and form credentials. Variants also bypass UAC, add Microsoft Defender exclusions, load vulnerable AMD driver PDFWKRNL.sys (CVE-2023-20598), DLL side-load through FnHotkeyUtility.exe, and may install NAIVEMESS for filesystem access.

GBHackersupdated Oct 7, 13:28 UTC · 1d agofirst Oct 7, 10:39 UTC · 1d agoMalware in the wild 5 sources CVE-2023-20598

100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

CERT-UA says UAC-0277 used fake Cloudflare checks on over 100 sites to deliver LunexStealer.

CERT-UA reported that threat cluster UAC-0277 injected JavaScript into more than 100 websites in September 2026 to deliver LunexStealer, also called Psychedelic Stealer. Visitors saw a forged Cloudflare check that used ClickFix to run a command and install a remote MSI, with EtherHiding pulling the lure domain and mode from Polygon or Ethereum smart contracts. The lure targeted Windows users arriving from search results and was limited to twice in 12 hours. Three MSI variants install the stealer directly, bypass UAC and abuse vulnerable AMD driver PDFWKRNL.sys, or sideload it through FnHotkeyUtility.exe and spkvol.dll. LunexStealer also installs the LUNARAXE extension to steal cookies, history, and form credentials and can deploy NAIVEMESS for file-system access.

The Hacker Newsupdated Oct 7, 13:28 UTC · 1d agofirst Oct 7, 06:57 UTC · 1d agoMalware in the wild 5 sources

ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware

A ClickFix campaign compromised over 100 Ukrainian websites to deliver the Lunex information stealer.

CERT-UA said attackers compromised more than 100 Ukrainian websites and showed visitors a fake Cloudflare check that told them to run a PowerShell command. Following the ClickFix instructions installed Lunex Stealer, which steals passwords, authentication tokens, and cryptocurrency wallets and can give remote access. Some infections add the LunarAxe Chromium extension, disguised as a Microsoft Word editor, and NaiveMess for file-system access. Ontinue describes Lunex as Russian-language malware-as-a-service; CERT-UA tracks the activity as UAC-0277 and has not named a group.

The Recordupdated Oct 7, 13:28 UTC · 1d agofirst Oct 6, 13:17 UTC · 2d agoMalware in the wild 5 sources

LUNARAXE

Timeline5 articles

Related CVEsby mentions

Appears with

Hackers Compromise 100+ Websites With Fake Cloudflare Checks to Spread LUNEXSTEALER

CERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware

LUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome Extension

100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware