100+ Sites Hijacked in Fake Cloudflare LunexStealer Campaign

Introduction

In a significant threat intelligence disclosure, the Computer Emergency Response Team of Ukraine (CERT-UA) has revealed a widespread compromise affecting more than 100 legitimate websites. These platforms have been silently weaponized to distribute LunexStealer — a potent information-stealing malware also known as Psychedelic Stealer — through cleverly disguised fake Cloudflare security checks. The campaign, observed throughout September 2026, demonstrates how threat actors increasingly abuse trust in familiar security interfaces to bypass user skepticism and deliver payloads at scale.

Anatomy of the Deceptive Delivery Chain

The attack begins when unsuspecting visitors land on a compromised website — ranging from small business portals to community forums and news outlets. Instead of the expected content, users encounter what appears to be a standard Cloudflare "Checking your browser" or "Verify you are human" interstitial page. These replicas are meticulously crafted, copying Cloudflare's branding, loading animations, and even the characteristic ray ID footer to create an illusion of legitimacy.

However, beneath the familiar interface lies malicious JavaScript designed to fingerprint the visitor's environment. The script checks for virtual machines, debuggers, and security tools before deciding whether to proceed. If the target passes these anti-analysis checks, the page triggers a download — often disguised as a browser update, security certificate, or CAPTCHA verification file — that actually contains the LunexStealer loader.

LunexStealer: A Modern Infostealer Arsenal

LunexStealer (tracked interchangeably as Psychedelic Stealer) represents the current generation of commodity malware-as-a-service infostealers. Written in .NET and heavily obfuscated, it targets a broad spectrum of sensitive data:

• Browser credential stores: Chrome, Edge, Firefox, Brave, Opera — extracting saved passwords, autofill data, cookies, and credit card information
• Cryptocurrency wallets: Browser extensions (MetaMask, Phantom, Coinbase Wallet) and desktop applications (Exodus, Electrum, Atomic Wallet)
• Authentication tokens: Session cookies for email, social media, gaming platforms, and developer services (GitHub, GitLab, Docker Hub)
• System intelligence: Hardware specs, installed software, running processes, network configuration, and screenshots
• File grabbing: Targeted collection of documents, databases, and configuration files matching specific patterns

Exfiltration occurs over encrypted channels to command-and-control infrastructure, often leveraging Telegram bots or Discord webhooks for low-profile data retrieval — a hallmark of modern stealer operations seeking to blend with legitimate traffic.

Attribution to UAC-0277: A Persistent Threat Cluster

CERT-UA attributes this campaign to UAC-0277, a threat cluster previously associated with credential harvesting and initial access brokerage targeting Ukrainian entities and broader Eastern European organizations. While the agency has not publicly linked UAC-0277 to a specific nation-state or cybercrime syndicate, the group's operational patterns — including infrastructure reuse, targeting consistency, and tooling evolution — suggest a structured, resourced operation rather than opportunistic script-kiddie activity.

Notably, UAC-0277 has shown adaptability in its delivery methods. Earlier campaigns utilized phishing emails with malicious attachments and compromised software downloads. The pivot to website compromise and fake Cloudflare pages reflects a strategic shift toward "watering hole" tactics that cast a wider net while reducing reliance on social engineering emails that face improving spam filters.

Why Fake Cloudflare Pages Work So Well

The effectiveness of this technique stems from several psychological and technical factors:

• Ubiquity breeds trust: Cloudflare protects millions of sites; users encounter its challenges daily and rarely question them
• Urgency and routine: Verification pages demand immediate action — "Wait 5 seconds," "Click to verify" — discouraging scrutiny
• Technical mimicry: Attackers replicate not just visuals but behavioral cues: delayed loading, dynamic ray IDs, proper HTTP headers
• Legitimate domain abuse: Compromised sites retain valid TLS certificates and reputation scores, evading URL reputation checks

This combination makes detection difficult for both users and automated systems. Traditional antivirus may miss the initial JavaScript, and network filters see only traffic to a known-good domain.

Detection and Mitigation Strategies

Organizations and individuals can reduce risk through layered defenses:

• Client-side protection: Deploy EDR solutions with behavioral analysis capable of detecting .NET assembly injection, credential store access, and anomalous child processes from browsers
• Network monitoring: Inspect TLS traffic for anomalies — unexpected file downloads from CMS admin panels, POST requests to newly registered domains, or traffic to known C2 infrastructure
• Website integrity: Site operators should implement file integrity monitoring (FIM), CSP headers, and regular malware scans. Subresource integrity (SRI) for third-party scripts adds another layer
• User awareness: Train staff to recognize that Cloudflare challenges never prompt file downloads. Legitimate verifications complete in-browser
• Threat intelligence integration: Feed IOCs (domains, IPs, file hashes) from CERT-UA and commercial feeds into SIEM and blocklists

Conclusion

The compromise of over 100 websites to serve LunexStealer via counterfeit Cloudflare checks is a stark reminder that the web's trust model remains fragile. As attackers refine their ability to clone security interfaces, the line between legitimate protection and malicious deception blurs further. Vigilance requires both technical controls — endpoint detection, network inspection, website integrity monitoring — and a cultural shift where users treat any unexpected download prompt with suspicion, regardless of how familiar the surrounding page appears. Grivyonx Cloud continues to track UAC-0277 and similar clusters, feeding real-time intelligence into our automated defense platform to help organizations stay ahead of evolving web-borne threats.