Hackers Compromise 100+ Websites With Fake Cloudflare Checks to Spread LUNEXSTEALER

Cybersecuritynews •Tushar Subhra Dutta • October 7, 2026

Hackers compromised more than 100 websites and used fake Cloudflare verification pages to spread LUNEXSTEALER, a Windows malware capable of stealing information and accepting remote commands. The campaign turned visits to legitimate websites into opportunities to infect visitors’ computers. The attackers added malicious JavaScript to website pages, making a familiar security check the starting point […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LunexStealer Malware Campaign Compromises 100+ Ukrainian Websites In September 2026, Ukraine's CERT-UA identified over 100 compromised websites used to distribute LunexStealer malware. The attackers injected malicious JavaScript into legitimate sites, prompting users to execute commands under the guise of a Cloudflare verification page. This ClickFix technique led to the installation of LunexStealer, which can steal sensitive information and provide remote access to attackers. The malware also installs a browser extension, LunarAxe, disguised as 'Microsoft Office Word Editor,' allowing extensive control over victims' browsers. CERT-UA has not disclosed the identities of the victims or the extent of the infections. The operation is tracked under the identifier UAC-0277, but no known hacking group has been attributed to it. The campaign highlights a growing trend of using social engineering to exploit users directly. 10 sources 67

Extracted Entities

Hackers Compromise 100+ Websites With Fake Cloudflare Checks to Spread LUNEXSTEALER

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)