CERT-UA: Over 100 Sites Injected With LunexStealer Malware via Fake Cloudflare Checks
Ukraine’s CERT-UA identified more than 100 compromised websites serving the LunexStealer malware through malicious JavaScript injections in September 2026.
Key points
- The Computer Emergency Response Team of Ukraine (CERT-UA) detected over 100 websites compromised to deliver LunexStealer.
- Attackers used malicious JavaScript disguised as Cloudflare security checks to bypass user suspicion.
- The campaign, observed in September 2026, is attributed to a threat cluster known as UAC-0277.
The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that are actively delivering the LunexStealer information-stealing malware to visitors. The agency observed this activity during September 2026 and attributed the campaign to a specific threat cluster designated as UAC-0277.
According to The Hacker News, the compromised sites were injected with malicious JavaScript designed to serve the malware, which is also known as Psychedelic Stealer. The attackers employed a social engineering tactic by disguising the malicious code as legitimate Cloudflare security checks. This deception likely aims to lower user suspicion and encourage interaction with the malicious payload, facilitating the installation of the stealer on victim devices.
Campaign Mechanics and Attribution
The core of this operation relies on the injection of malicious scripts into otherwise legitimate web properties. By framing the malicious execution as a standard Cloudflare verification step, the threat actors attempt to normalize the presence of the script in the user's browser. CERT-UA did not disclose the specific identity of the group behind UAC-0277 in the provided report. The attribution remains at the cluster level, indicating a coordinated effort or shared infrastructure among the operators.
LunexStealer, or Psychedelic Stealer, is classified as information-stealing malware. While the source material does not detail the specific data exfiltration capabilities of this variant, stealer malware typically targets credentials, cookies, and other sensitive user data stored in browsers and local applications. The use of a fake Cloudflare check suggests a sophisticated understanding of user trust signals, as Cloudflare is a widely recognized provider of web infrastructure and security services.
Who Is Affected
The immediate victims of this campaign are visitors to the more than 100 compromised websites identified by CERT-UA. The report does not specify which industries or geographic regions these websites belong to, nor does it list the specific URLs affected. However, the scale of the campaign—impacting over a hundred distinct web properties—indicates a broad targeting strategy rather than a narrow, spear-phishing approach.
Users who visited these sites during the observation period in September 2026 may have been exposed to the malicious JavaScript. The risk persists as long as the injected code remains active on the compromised servers. Because the attack vector relies on the user loading the webpage, any visitor who interacted with the site could potentially have had the malware served to their device, depending on their browser configuration and security settings.
What should you do?
Security professionals should monitor for indicators of compromise associated with the LunexStealer malware and the UAC-0277 threat cluster. Organizations should review web server logs for unusual JavaScript injections or unauthorized modifications to site files. Additionally, verifying the integrity of web assets and ensuring that only authorized scripts are loaded can help mitigate the risk of drive-by downloads.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: LunexStealer
- Scan endpoints for signs of LunexStealer or Psychedelic Stealer using up-to-date threat intelligence feeds.
- Review web server logs for unexpected JavaScript injections or changes to legitimate site files.
- Verify that all web assets are loaded from trusted sources and have not been tampered with.
- Educate users to be cautious of unexpected security checks or prompts that appear while browsing.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is LunexStealer?
LunexStealer, also known as Psychedelic Stealer, is an information-stealing malware delivered via malicious JavaScript injections on compromised websites.
Who is behind the UAC-0277 threat cluster?
CERT-UA attributed the activity to the UAC-0277 threat cluster but did not disclose the specific identity of the group or individuals responsible.
When was this activity observed?
The Computer Emergency Response Team of Ukraine observed the activity involving more than 100 compromised websites in September 2026.
