100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer (aka Psychedelic Stealer). The activity, which was observed by the agency in September 2026, has been attributed to a threat cluster dubbed UAC-0277. It did not disclose who the

CERT-UA reported that more than 100 compromised websites used malicious JavaScript and fake Cloudflare verification pages to trick visitors into executing commands that installed LunexStealer, an information-stealing malware. The campaign was attributed to UAC-0277 and used the ClickFix technique to steal credentials, authentication tokens, cryptocurrency-wallet data, and potentially enable remote access. The report does not identify an AI component; RealGround classifies it under malicious AI use only because that is the permitted fallback category. The practical implication is that organizations should strengthen security awareness, endpoint controls, and red-team testing against social-engineering-driven malware delivery.