The Computer Emergency Response Team of Ukraine (CERT-UA) has identified a campaign in which more than 100 compromised websites were injected with malicious JavaScript designed to deliver LunexStealer, also known as Psychedelic Stealer. The threat activity, observed in September 2026, has been attributed to the threat cluster UAC-0277. The malicious payload uses fake Cloudflare checks as a delivery mechanism to evade basic security scrutiny. Visitors to the affected sites risk infection that leads to the theft of sensitive information including credentials, personal data, and browser-stored content.

What should defenders do?

Website owners should perform comprehensive security audits to identify and remove unauthorized JavaScript injections. Applying strict Content Security Policy (CSP) headers, reviewing file integrity, and keeping all content management systems and plugins up to date are recommended. Users should ensure browsers and security software are current and exercise caution when encountering unexpected security verification prompts.

highMalware

Over 100 Compromised Websites Deploy LunexStealer via Fake Cloudflare Checks

CERT-UA attributes campaign to UAC-0277; malicious JavaScript injections target visitors to steal credentials and browser data

Cyber.TechVoidPublished about 1 hour agoUpdated less than a minute ago1 min read

Over 100 Compromised Websites Deploy LunexStealer via Fake Cloudflare Checks

Key Takeaways

Over 100 compromised websites were injecting malicious JavaScript to deliver LunexStealer.
The attack uses fake Cloudflare checks to evade detection and trick visitors into executing the payload.
The campaign is attributed to the threat cluster UAC-0277, as tracked by CERT-UA.

Related Security News

highMalware

16 Malicious Firefox Extensions Disguised as Crypto Wallets Steal Recovery Phrases

Cybersecurity researchers have uncovered a cluster of 16 malicious Mozilla Firefox extensions that masquerade as legitimate cryptocurrency wallet interfaces and desktop utilities. The extensions intercept and steal recovery phrases and private keys during wallet import flows, attempting to exfiltrate the sensitive data to remote servers controlled by threat actors. The add-ons were distributed through addons.mozilla.org and similar channels, targeting cryptocurrency users globally.

The Hacker News1 minute ago1 min read

Over 100 Compromised Websites Deploy LunexStealer via Fake Cloudflare Checks

Key Takeaways

Related Security News

16 Malicious Firefox Extensions Disguised as Crypto Wallets Steal Recovery Phrases

Quick answers

Security Details

Sources

Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

ClickFix Technique Exploits Browser Cache to Smuggle and Execute Malicious Payloads

PoeLLM Malware Deployed in Cryptomining Campaigns Targeting Exposed AI Services

Canto Incognito Malware Targets Exposed AI and LLM Infrastructure, Infects 3,400+ Servers

Eight Malicious npm Packages Deliver Overlord RAT and Stealer in Supply Chain Campaign