Malware
ClickFix Campaign in Ukraine Deploys Lunex Infostealer via Fake Cloudflare Pages
Over 100 Ukrainian websites were hijacked to serve a counterfeit Cloudflare verification page that prompted users to run a PowerShell command. The command installed Lunex Stealer, an infostealer that also installs the LunarAxe browser extension and NaiveMess component, giving attackers credential theft and remote control. Defenders should block malicious domains, monitor for Lunex signatures, and educate users against executing unknown scripts.
What Happened
In September, CERT‑UA uncovered a campaign that compromised more than 100 Ukrainian websites. Attackers injected JavaScript that displayed a counterfeit Cloudflare “I’m not a robot” page. The page instructed visitors to copy a PowerShell command that, when executed, downloaded and installed Lunex Stealer.
Technical Details
Lunex is a modular infostealer that collects passwords, authentication tokens, and crypto wallet data. It also installs the LunarAxe extension for Chromium‑based browsers, masquerading as "Microsoft Office Word Editor". LunarAxe steals cookies, browsing history, and credentials, and can manipulate tabs, run JavaScript, take screenshots, and alter proxy settings. The NaiveMess component extends the attack beyond the browser, allowing file‑system access, program execution, and directory traversal.
Impact
While CERT‑UA has not quantified the number of infected machines, the campaign targeted diverse sites, including an online store and a children’s coloring‑page portal. Victims who followed the instructions became hosts for credential theft and remote command execution.
What to Do
- Block or quarantine the domains and IPs identified by CERT‑UA as part of the campaign.
- Deploy endpoint detection that flags the Lunex installer, LunarAxe extension, and NaiveMess binaries.
- Educate users not to run PowerShell commands received from unverified web pages.
- Inspect browser extensions for unfamiliar entries and remove any that mimic legitimate software.
- Apply the latest patches for Windows, browsers, and any affected web‑application platforms.
Related articles
ClickFix Campaign Compromises Ukrainian Sites, Deploys Psychedelic Stealer via Fake Cloudflare Verification
An active ClickFix campaign has injected fake Cloudflare verification pages into legitimate Ukrainian business sites, tricking visitors into running an MSI installer that delivers the Psychedelic stealer. The malware harvests credentials, cryptocurrency wallet data, and establishes persistence via scheduled tasks. Defenders should block the attacker domains, detect MSI executions, and harden web applications against iframe injection.
Read briefing
Mac Malware Uses Fake CAPTCHA to Steal Keychain Credentials and Drain Crypto Wallets
A Go‑based malware delivered via a ClickFix phishing scam infected macOS systems by executing a terminal command. The payload extracts Keychain passwords and drains cryptocurrency wallets. Defenders should block the malicious domain, update EDR signatures, and audit Keychain access logs.
Read briefing
MacSync macOS Infostealer Adopts Binary Droppers and iCloud Staging
Security researchers have detailed an updated campaign involving the MacSync macOS infostealer and backdoor, targeting crypto users and developers. The latest variant abandons script-based droppers in favor of compiled Objective-C and Swift binaries, leveraging iCloud for payload delivery during multi-stage infections.
Read briefing
Fake LastPass Installers Deploy Kernel-Driver EDR Killer and Rapuncel Infostealer
A campaign using counterfeit LastPass Authenticator apps has pushed a Microsoft‑attested kernel driver that disables 145 security products and installs the Rapuncel infostealer. The attack leveraged GitHub and Cloudflare to distribute the malicious payload, impersonating at least 40 organizations. Defenders should block the malicious driver, verify kernel modules, and update EDR signatures.
Read briefing