100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
CERT-UA says UAC-0277 used fake Cloudflare checks on over 100 sites to deliver LunexStealer.
78
- Mentions · 7d0
- Mentions · 30d2
- All mentions4
- First seenAug 18, 2026
- Last mentioned24d ago
Timeline
4 articles · newest firstClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware
A ClickFix campaign compromised over 100 Ukrainian websites to deliver the Lunex information stealer.
71
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
Ontinue details LunexStealer MaaS using BYOVD with AMD's PDFWKRNL.sys (CVE-2023-20598) to blind EDR before stealing credentials and crypto wallets.
55
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
Ontinue disclosed TWINLOOT, a Python implant hiding C2 in SharePoint dead drops and Teams TURN relays, harvesting credentials and pivoting via reverse SOCKS5.
60
Related CVEs
by mentions- CVE-2023-20598<1%7.8An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over…
Appears with
- Microsoftvendor · 3
- Cloudflarevendor · 2
- LunarAxemalware · 2
- Psychedelic Stealermalware · 2
- UAC-0277threat actor · 2
- NaiveMessmalware · 2
- Microsoft Edgeproduct · 2
- CERT-UAorganization · 2
- Google Chromeproduct · 1
- Microsoft Graph APIproduct · 1
- Ontinuevendor · 1
- PowerShellproduct · 1
- Windowsproduct · 1
- AMDorganization · 1
- Googlevendor · 1
- Lunexorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.