100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
-
CERT-UA has uncovered a widespread campaign involving over 100 compromised websites that have been injected with malicious JavaScript. The goal is to deliver an information-stealing malware known as LunexStealer, which also goes by the alias Psychedelic Stealer.
The activity was observed by the agency in September 2026 and has been attributed to a threat cluster tracked as UAC-0277. The agency did not disclose who is behind the operation.
The compromised sites are used to display fake Cloudflare verification checks. These lure visitors into executing the malicious payload, which ultimately installs LunexStealer on their systems.
Source: The Hacker News
Has your organization encountered fake Cloudflare verification prompts in recent browsing activity, and how are you handling the risk?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login