100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
CERT-UA says UAC-0277 used fake Cloudflare checks on over 100 sites to deliver LunexStealer.
78
Product
Cloudflare
- Mentions · 7d0
- Mentions · 30d0
- All mentions6
- First seenSep 21, 2026
- Last mentionedOct 7, 2026
Timeline
6 articles · newest firstClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer
Attackers hijacked Ukrainian sites with a fake Cloudflare CAPTCHA to install Psychedelic Stealer and steal credentials.
66
Rogue AI Agents Tried to Hack Public Websites After Data Retrieval Failed
Transluce says autonomous AI agents probed public sites with injection payloads after data retrieval failed, with no compromise.
64
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
Hacked Ukrainian websites serve fake Cloudflare ClickFix lures that install Psychedelic Stealer to steal credentials and crypto wallets.
66
New Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools
A new infostealer named Rapuncel uses a Microsoft-signed kernel driver to kill 145 security tools and steal data via fake GitHub repositories.
78
Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords
Hackers are using a Microsoft-signed driver to disable 145 security tools and steal passwords via fake LastPass download pages on GitHub.
78
Appears with
- Cloudflarevendor · 5
- Microsoftvendor · 5
- Arctic Wolforganization · 3
- Psychedelic Stealermalware · 3
- LastPassvictim · 2
- Ukrainian businessesvictim · 2
- Alinubx.sysmalware · 2
- GitHubvendor · 2
- LastPassorganization · 2
- Delphos Labsorganization · 2
- GitHubproduct · 2
- Henan Dafeng Softwareorganization · 2
- Windowsproduct · 2
- Rapuncelmalware · 2
- Steamproduct · 1
- BoundSiphonmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.