More than 100 compromised websites are being used to distribute an information-stealing malware called LunexStealer, with attackers disguising the infection process as a familiar Cloudflare human-verification check.
Ukraine’s Computer Emergency Response Team, CERT-UA, identified the campaign in September and attributed it to a threat cluster tracked as UAC-0277. Rather than exploiting visitors automatically, the operation relies on social engineering: victims are instructed to execute a Windows command themselves, unknowingly starting the malware installation.
The campaign combines several increasingly popular techniques — ClickFix lures, compromised websites, blockchain-based infrastructure and abuse of legitimate Windows components — to make a relatively simple infection chain much harder to disrupt.
A Fake Cloudflare Check Starts the Infection
Visitors to compromised websites can be presented with a fraudulent Cloudflare verification page claiming they need to prove they are human. The instructions ultimately convince the victim to run a command that downloads and installs a malicious MSI package.
This technique, commonly known as ClickFix, has become increasingly popular because it moves part of the attack outside the browser. Instead of relying on a browser vulnerability, attackers persuade users to execute the malicious command themselves.
The campaign is also selective. The fake verification page is displayed only to Windows users arriving through search-engine results and appears no more than twice within a 12-hour period. That reduces unnecessary exposure and may help the malicious code remain unnoticed by administrators and automated scanners.
Attackers Hide Their Infrastructure on the Blockchain
UAC-0277 adds another layer of resilience through a technique known as EtherHiding.
Rather than embedding all of the campaign’s configuration directly inside the compromised websites, malicious JavaScript retrieves information from smart contracts hosted on the Polygon or Ethereum blockchain. That data determines where the fake verification page should be loaded from and how the malicious script should behave.
CERT-UA identified three modes. The script can remain inactive, quietly collect information about visitors, or display the malicious Cloudflare-style page.
Using blockchain infrastructure complicates takedowns because defenders cannot simply seize or suspend a traditional command-and-control domain to eliminate the configuration source.
LunexStealer Goes After the Browser
Researchers discovered at least three different MSI infection variants.
The simplest installs LunexStealer directly. A more aggressive version attempts to bypass Windows User Account Control, creates Microsoft Defender exclusions and abuses a legitimate but vulnerable AMD driver to interfere with security software before downloading the stealer.
Another variant relies on DLL sideloading, using a legitimate executable to load a malicious DLL that decrypts and launches LunexStealer.
Once installed, the malware can deploy a malicious browser extension called LUNARAXE, which masquerades as “Microsoft Office Word Editor.” The extension can steal cookies, browsing history and credentials entered into web forms while also giving attackers significant control over the browser.
Operators can manipulate tabs, execute JavaScript inside pages, display fake overlays and interfere with other browser extensions. A companion component called NAIVEMESS extends that access into the Windows file system, allowing attackers to browse directories, read or overwrite files and execute them.
The Browser Is Becoming a Valuable Attack Surface
The campaign reflects a broader change in information-stealing malware. Attackers are increasingly interested not only in passwords stored on a computer but in the authenticated browser itself.
Modern browsers contain session cookies, saved credentials and active access to email, cloud platforms and business applications. Stealing those sessions can sometimes allow attackers to bypass the need to obtain a password or defeat multifactor authentication directly.
CERT-UA recommends restricting access to the Windows Run dialog where appropriate, preventing non-administrators from installing MSI packages, monitoringmsiexec.exe, enabling Microsoft’s vulnerable-driver protections and restricting browser extensions to approved lists.
The campaign also shows why fake CAPTCHA and verification pages have become such effective social-engineering tools. Users have been trained to expect occasional friction when websites check whether they are human, giving attackers a familiar interface they can imitate.
In this case, the most important exploit is not a software vulnerability.It is convincing users that manually executing an attacker-controlled command is simply another routine security check.