Hackers Compromise 100+ Websites With Fake Cloudflare Checks to Spread LUNEXSTEALER

Hackers compromised more than 100 websites and used fake Cloudflare verification pages to spread LUNEXSTEALER, a Windows malware capable of stealing information and accepting remote commands. The campaign turned visits to legitimate websites into opportunities to infect visitors’ computers. The attackers added malicious JavaScript to website pages, making a familiar security check the starting point for infection. Similar fake Cloudflare verification attacks have used this approach to persuade visitors to run commands rather than download an obviously suspicious attachment. CERT-UA researchers identified the activity in September 2026 and tracked it as UAC-0277. CERT-UA said in a report shared with Cyber Security News (CSN), published September 30, that its analysts examined three installer variants used to…