iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CERT-UA reported that it identified more than 100 compromised websites in September 2026 that were used in a campaign tracked as UAC-0277. The sites could show selected visitors a fake Cloudflare verification prompt and persuade them to run a command that downloaded an MSI installer for Lunex Stealer. The figure counts compromised websites—not infected computers or confirmed victims.
How the ClickFix lure worked
Attackers injected JavaScript into legitimate websites. In the campaign’s “mode 2,” the script showed a counterfeit Cloudflare check only to Windows users who had arrived through a search engine. It limited the prompt to no more than two displays per visitor in a 12-hour period.
The prompt claimed that running a command would verify the visitor was human. In reality, the command downloaded and installed an MSI package from a remote server. CERT-UA classifies this kind of instruction to make a user execute a command as ClickFix.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhy the fake check could change
The injected script retrieved its operating mode and the domain used for the fake check from a smart contract on Polygon or Ethereum. This gave the campaign operators a way to change those settings centrally, without updating the JavaScript on each compromised site.
#1 Best Overall
What the three MSI variants did
CERT-UA examined three installer variants. They did not all use the same route to deploy the stealer:
- Direct installation: One variant installed Lunex Stealer directly.
- Privilege and defense evasion: A second attempted to bypass Windows User Account Control and add exclusions to Microsoft Defender. It also used the vulnerable AMD driver PDFWKRNL.sys in a bring-your-own-vulnerable-driver (BYOVD) technique associated with CVE-2023-20598, then retrieved Lunex.
- DLL side-loading: A third used the legitimate FnHotkeyUtility.exe program to load a malicious spkvol.dll file, which decrypted and launched the stealer.
What Lunex Stealer can access and do
CERT-UA describes LUNEXSTEALER as 64-bit Windows malware with both information-stealing and remote-task capabilities. Its documented functions include stealing saved browser passwords and tokens, desktop and browser cryptocurrency-wallet information, and system details. It can also download and run executable files, MSI packages, PowerShell scripts, and commands through cmd.exe.
Optional browser-extension capabilities
Depending on its configuration, Lunex can install LUNARAXE, a malicious Chromium-based extension that appears under the name “Microsoft Office Word Editor.” The documented extension capabilities include stealing cookies, browsing history, and credentials entered into web forms; running JavaScript remotely on pages; controlling tabs; capturing images of tabs; and changing proxy settings.
Recommended Free Tools
When the NAIVEMESS component is present, the extension can also use Windows file-system functions to list drives and directories, read and write files, and launch files. These are reported capabilities of the components, not evidence that every infected device received every component or that each function was used in every case.
Rank #3
What to do if a site asks you to run a command
Close the page. Do not press Win+R, open Command Prompt or PowerShell, or paste and run a command because a website tells you to. CERT-UA emphasizes that a legitimate “I am not a robot” check does not require any of those actions—even if the prompt appears on a familiar website.
If you already ran a command, stop using the device for sensitive activity and contact your organization’s IT or security team if the device is work-managed. For a personal computer, seek help from a trusted security professional. The advisory does not establish a universal cleanup procedure for every affected device, so avoid assuming that deleting the downloaded file alone removes an installation or reverses possible data access.
Controls CERT-UA recommends for administrators
- Use Group Policy to restrict access to Run for ordinary users.
- Limit MSI installation by users who do not have administrator rights.
- Monitor msiexec.exe activity, especially when its command line contains a URL.
- Enable the Microsoft Vulnerable Driver Blocklist.
- Restrict browser-extension installation to an approved allowlist.
What the report does—and does not—establish
The more-than-100 figure is CERT-UA’s count of compromised websites identified during September 2026. The advisory does not name the affected website owners or provide a confirmed total of infected computers. It also does not establish whether a particular visitor’s data was stolen. Because the fake prompt had targeting conditions and required a visitor to execute a command, visiting one of the compromised sites alone does not prove that a device was infected.
Free tools Windows power users keep installed
One-click scans. No signup required.
The campaign details and recommendations above are from CERT-UA’s advisory dated September 30, 2026. A secondary Cybersecurity Help report published in October 2026 also summarized the compromise and delivery chain; CERT-UA is the primary source for the technical specifics.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
