Threat Actors Hijack 100+ Websites With Fake Cloudflare CAPTCHAs To Drop LunexStealer

CERT-UA identified a September 2026 campaign by threat cluster UAC-0277 compromising over 100 websites to distribute LunexStealer. The attackers utilize a "ClickFix" technique, displaying a forged Cloudflare human verification page that prompts Windows users to execute a malicious command. Command execution downloads an MSI package containing the LunexStealer payload alongside a malicious browser extension called LUNARAXE. The malware utilizes an "EtherHiding" technique to dynamically retrieve command-and-control domains via smart contracts hosted on the Polygon and Ethereum networks. The bogus verification page is intentionally restricted, showing only to Windows users arriving from search engine results a maximum of twice in 12 hours. "When visiting such a site, users were shown a forged Cloudflare verification page that, under the pretext of confirming the visitor is human, prompted them to execute a command." — CERT-UA