Fake Cloudflare checks push ClickFix commands to Windows and Mac users
Commands pointed to api-com.cfd and cf-id.com, but neither yielded a payload, so the malware remains unknown.
56
- Mentions · 7d4
- Mentions · 30d20
- All mentions30
- First seenAug 12, 2026
- Last mentioned1d ago
Timeline
30 articles · newest firstCERT-UA: attackers control Dahua cameras and recorders via Easy4IP
Devices with Easy4IP dial out to Dahua’s cloud and can be opened by serial number without a public IP or open ports.
74
CERT-UA warns Dahua cameras in Ukraine hijacked via P2P and auth flaws
Attackers guess Easy4IP serial numbers and use weak passwords or CVE-2021-33044 and CVE-2021-33045 on outdated firmware.
76
CERT-UA warns hackers are compromising Dahua surveillance cameras
Attackers use Easy4IP serial patterns, weak passwords or outdated firmware to reach cameras even when they sit behind firewalls.
72
UAC-0099 handed Ukraine grain firm access to Sandworm
MythicRatatoskr used Yggdrasil for C2; Sandworm later wiped data with SDelete via Group Policy.
76
APT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
78
MATCHBOIL Malware Uses Cloudflare-Hidden C2 Servers to Deliver Backdoor Payloads
UAC-0099's MATCHBOIL downloader hides C2 behind Cloudflare and delivers MATCHWOK to Ukrainian firms.
66
MATCHBOIL Malware Adds Sandbox Checks, .NET Reactor Obfuscation and Persistent C2
UAC-0099's MATCHBOIL downloader evolved with sandbox checks, .NET Reactor obfuscation, scheduled-task persistence, and recurring C2, hitting Ukrainian transport and energy firms.
58
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
Russia-aligned UAC-0099 deployed the ASHVEIN RAT against Ukrainian government staff, hiding tasking in HTML.
78
Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware
ESET documents two years of UAC-0099 upgrades to its MATCHBOIL downloader used in espionage against Ukrainian government, energy and transport sectors.
55
Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms
UAC-0099 upgraded MatchBoil malware in espionage attacks on Ukrainian transport and energy firms.
74
What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor
Russia-aligned UAC-0099 uses MATCHBOIL to install the MATCHWOK spy backdoor on Ukrainian transport, manufacturing, and energy firms.
76
MATCHBOIL: New tricks, same old evil intentions
ESET details MATCHBOIL, a C# downloader UAC-0099 uses against Ukrainian transport, manufacturing, and energy firms.
67
Hackers Compromise 100+ Websites With Fake Cloudflare Checks to Spread LUNEXSTEALER
Attackers compromised over 100 sites with fake Cloudflare checks to install Windows infostealer LUNEXSTEALER.
71
CERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware
CERT-UA says over 100 hacked sites used fake Cloudflare checks to install LunexStealer via ClickFix.
74
Earth Sirrush Uses PNG Steganography and Malicious Notepad++ Plugins to Deploy Espionage Malware
Russia-aligned Earth Sirrush hides espionage malware in PNGs and Notepad++ plugins against Ukrainian government and defense targets.
74
LUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome Extension
CERT-UA reports LUNEXSTEALER installs LUNARAXE for remote Chromium control after fake Cloudflare prompts.
72
Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine
Earth Sirrush has spear-phished Ukrainian government and logistics since 2022, possibly feeding Sandworm.
78
100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
CERT-UA says UAC-0277 used fake Cloudflare checks on over 100 sites to deliver LunexStealer.
78
ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware
A ClickFix campaign compromised over 100 Ukrainian websites to deliver the Lunex information stealer.
71
Mobile malware warning from Ukrainian researchers includes iPhone exploit kit
Ukraine warns Russian-aligned hackers are infecting military and officials' iPhones and Android phones for espionage.
76
This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move
Talos analyzed CLOSEDQUORUM, Windows malware that lets up to four AI models vote on its next action.
68
OpenAI extends cyber access to Ukraine for civilian defense
OpenAI will give Ukraine Daybreak access to find and fix vulnerabilities in civilian infrastructure.
62
Researchers uncover malware that uses AI to choose its next move
Cisco Talos documents CLOSEDQUORUM, a Windows implant that lets commercial LLMs vote on its next action.
66
Hackers Weaponize AI Safety Guardrails to Hide Malware From LLM-Powered Security Scanners
ESET says Russia-aligned actor UAC-0099 hid guardrail-triggering comments in VBScript to derail LLM-based malware scanners in Ukraine.
58
Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis
Russia-aligned UAC-0099 planted a nuclear-weapon prompt inside malicious VBS scripts to derail LLM-based malware analysis targeting Ukraine.
58
Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails
ESET reports Russian group UAC-0099 hid a prompt in VBS malware comments to trip AI safety filters and disrupt automated malware analysis in Ukraine.
58
The AI Malware Maturity Gap
Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.
55
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
CERT-UA says Sandworm-linked UAC-0145 poses as recruiters in fake job interviews to deliver a trojanized WireGuard VPN that runs attacker commands on victims' hosts.
72
Lazarus hackers pair fake job offers with Windows zero-day exploit
Lazarus' Operation Dream Job targets the defense sector with fake job offers, a Windows LPE zero-day (CVE-2026-68820), and new Troy and RelayShell backdoors.
82
Related CVEs
by mentions- CVE-2021-33045100%9.8Authentication Bypass in Dahua IP Cameras, NVRs and Video Intercoms
- CVE-2021-33044100%9.8Authentication Bypass in Dahua IP Camera Firmware
- CVE-2023-20598<1%7.8An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over…
- CVE-2023-38831100%7.8Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion
- CVE-2025-4911399%8.8Authenticated PHP Object Deserialization RCE in Roundcube Webmail
- CVE-2026-68820<1%7.0Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
Appears with
- UAC-0099threat actor · 11
- ESETorganization · 11
- MatchBoilmalware · 10
- Sandwormthreat actor · 9
- Microsoftvendor · 8
- MatchWokmalware · 7
- Windowsproduct · 7
- LunarAxemalware · 5
- LunexStealermalware · 5
- NaiveMessmalware · 5
- UAC-0277threat actor · 4
- Microsoft Defenderproduct · 4
- AMDvendor · 4
- Cloudflarevendor · 4
- ESETvendor · 4
- Dragstaremalware · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.