100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

CERT-UA identified over 100 compromised websites injected with malicious JavaScript to distribute an information-stealing malware known as LunexStealer, also referred to as Psychedelic Stealer. The campaign was observed in September 2026 and attributed to the threat cluster UAC-0277. The attack technique involves fake Cloudflare verification checks to trick users into executing the malware. The widespread nature of the campaign, affecting more than 100 websites, indicates a coordinated and large-scale operation. The malware is designed to steal sensitive information from infected systems. CERT-UA has not yet disclosed the identity of the threat actors behind UAC-0277.