Hackers Compromise 100+ Websites With Fake Cloudflare Checks to Spread LUNEXSTEALER
Read with caution - this story is only being covered by one news source that has a ‘low factuality’ rating, which means the outlet has a history of poor reporting practices. Learn more about factuality ratings here.7 Articles
7 Articles
In this article, we will review the details of this campaign and the methods of attack used. The hacked websites using Klodfler's fake LunexStealer's scans have identified hacking sites using Klodfler's fake scans for distribution of LunexStealer's computer emergency response team... the article shows hacking sites using Klodfler's fake test to distribute LunxStealer's first to Battery Robotk.
CERT-UA has discovered a campaign that has compromised over 100 legitimate Ukrainian websites to serve Cloudflare's false CAPTCHAs with the ClickFix technique. Behind the infrastructure, controlled by a smart contract on blockchain, Lunex Stealer hides: theft of credentials, wallet crypto and a BYOVD system that blinds Defender using an old AMD driver. The article UAC-0277: over 100 Ukrainian sites transformed into ClickFix traps to distribute L…
Hackers Compromise 100+ Websites With Fake Cloudflare Checks to Spread LUNEXSTEALER
Hackers compromised more than 100 websites and used fake Cloudflare verification pages to spread LUNEXSTEALER, a Windows malware capable of stealing information and accepting remote commands. The campaign turned visits to legitimate websites into opportunities to infect visitors’ computers. The attackers added malicious JavaScript to website pages, making a familiar security check the starting point […]
100+ Ukrainian Websites Hacked to Install Lunex Stealer with ClickFix Lure
More than 100 legitimate websites in Ukraine were compromised and modified to display fake Cloudflare verification pages that installed information-stealing (infostealer) malware on Windows computers. Ukraine’s Computer Emergency Response Team, CERT-UA, identified the campaign in September 2026 and tracks its unidentified operators as UAC-0277. The affected sites included an online shop and a website offering
The Hacker News
IT Security News - cybersecurity, infosecurity news100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer (aka Psychedelic Stealer). The activity, which was observed by the agency in September 2026, has been attributed to a threat cluster dubbed UAC-0277. It did not disclose who the
Hackers use more than 100 hacked sites that host fake Cloudflare verification pages.
Coverage Details
Bias Distribution
- 100% of the sources lean Right
Factuality
To view factuality data please Upgrade to Premium
