100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
CERT-UA says UAC-0277 used fake Cloudflare checks on over 100 sites to deliver LunexStealer.
78
Malware
Psychedelic Stealer
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenSep 24, 2026
- Last mentionedOct 7, 2026
Timeline
4 articles · newest firstLunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
Ontinue details LunexStealer MaaS using BYOVD with AMD's PDFWKRNL.sys (CVE-2023-20598) to blind EDR before stealing credentials and crypto wallets.
55
ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer
Attackers hijacked Ukrainian sites with a fake Cloudflare CAPTCHA to install Psychedelic Stealer and steal credentials.
66
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
Hacked Ukrainian websites serve fake Cloudflare ClickFix lures that install Psychedelic Stealer to steal credentials and crypto wallets.
66
Related CVEs
by mentions- CVE-2023-20598<1%7.8An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over…
Appears with
- Arctic Wolforganization · 3
- Cloudflareproduct · 3
- Microsoftvendor · 3
- Cloudflarevendor · 2
- Ukrainian businessesvictim · 2
- Ontinueorganization · 2
- Windowsproduct · 2
- AMDvendor · 1
- Google Chromeproduct · 1
- AMDorganization · 1
- Microsoft Edgeproduct · 1
- Lunexorganization · 1
- Googlevendor · 1
- LunexStealermalware · 1
- UAC-0277threat actor · 1
- NAIVEMESSmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.