Back Babel.Ua

Hackers massively spread malicious hijacker viruses through 100 hacked sites

Babel.Ua • October 6, 2026

CERT-UA specialists have discovered a new large-scale malware distribution campaign. Hackers are using over 100 compromised sites to host fake Cloudflare verification pages.

This is stated on the website of the State Special Communications Service.

In September alone, experts detected over 100 compromised web resources with malicious JavaScript code. The attack targeted Windows users who navigate to sites from engines.

The fake page prompts the user to complete the "Iʼm not a robot" verification, but instead of the usual CAPTCHA, they are asked to press Win+R, open a command prompt or PowerShell, and execute the suggested command. After that, malware is installed on the computer.

CERT-UA emphasizes: real CAPTCHAs and Cloudflare checks never ask to execute commands via Win+R, the command line, or PowerShell. If a site requests this, the page should be closed immediately.

Once infected, the virus silently installs a malicious extension in the victimʼs browser disguised as Microsoft Office Word Editor. This tool completely steals logins, passwords, and browsing history, and also allows hackers to remotely control the computer.

CERT-UA urged owners of hacked sites and users who have encountered such an attack to the team at [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LunexStealer Malware Campaign Compromises 100+ Ukrainian Websites In September 2026, Ukraine's CERT-UA identified over 100 compromised websites used to distribute LunexStealer malware. The attackers injected malicious JavaScript into legitimate sites, prompting users to execute commands under the guise of a Cloudflare verification page. This ClickFix technique led to the installation of LunexStealer, which can steal sensitive information and provide remote access to attackers. The malware also installs a browser extension, LunarAxe, disguised as 'Microsoft Office Word Editor,' allowing extensive control over victims' browsers. CERT-UA has not disclosed the identities of the victims or the extent of the infections. The operation is tracked under the identifier UAC-0277, but no known hacking group has been attributed to it. The campaign highlights a growing trend of using social engineering to exploit users directly. 10 sources 67

Extracted Entities

Hackers massively spread malicious hijacker viruses through 100 hacked sites

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)