ClickFix Campaign Delivers LunexStealer via Fake Cloudflare Pages on 100+ Sites
ClickFix Campaign Delivers LunexStealer via Fake Cloudflare Pages on 100+ Sites
CERT-UA has identified more than 100 compromised websites injected with malicious JavaScript that displays fake Cloudflare verification pages to trick Windows users into running a command that installs LunexStealer. Endpoint and identity teams should map current detection coverage against the specific evasion techniques used.
CERT-UA, observing activity in September 2026, attributed the campaign to threat cluster UAC-0277. The attack chain works as follows:
- Compromised websites are injected with JavaScript that fetches attacker-controlled configuration from a Polygon or Ethereum smart contract using the EtherHiding technique. This configuration sets one of three operating modes: inactive (0), passive visitor tracking (1), or active lure display (2).
- In Mode 2, a fake Cloudflare human-verification page is shown only to Windows users arriving from search engine results, and no more than twice within a 12-hour window.
- The page prompts the user to execute a command via the Windows Run dialog (ClickFix technique), which downloads and installs a malicious MSI package.
Three MSI variants have been identified:
- Variant 1 installs LunexStealer directly.
- Variant 2 attempts UAC bypass, adds Microsoft Defender exclusions, loads the legitimate but vulnerable AMD driver
PDFWKRNL.systo disable security software, then retrieves and runs LunexStealer from a remote server. - Variant 3 uses DLL sideloading: the legitimate binary
FnHotkeyUtility.exeloads a rogue DLL (spkvol.dll), which decrypts and executes LunexStealer.
LunexStealer installs a malicious browser extension called LUNARAXE, which masquerades as "Microsoft Office Word Editor." LUNARAXE comprises three modules:
- LUNARAXE.CORE handles C2 communication, exfiltrates cookies, browsing history, bookmarks, installed extension details, and intercepted credentials. It can manage tabs, enable or disable extensions, serve notifications, run JavaScript on pages, display fake overlays, and read or write files and execute them if NAIVEMESS is present.
- LUNARAXE.STEALER captures credentials entered into web forms and forwards them with the page URL to LUNARAXE.CORE.
- LUNARAXE.STRIP removes Content Security Policy headers from HTTP responses to allow arbitrary JavaScript execution on pages.
An auxiliary component named NAIVEMESS is installed based on C2 configuration. It provides LUNARAXE with file system access through a PowerShell-based Native Messaging Host. Capabilities include listing drives, browsing directories, reading, creating, overwriting, and executing files. Files are transferred in Base64-encoded chunks; directories and file groups are pre-archived as ZIP. NAIVEMESS does not have its own C2 channel; it receives commands through LUNARAXE.
The source states the campaign targets Windows users who arrive at compromised websites via search engine results. CERT-UA did not disclose the identities of victims or confirm whether any systems were successfully compromised. The source does not specify industries, geographies beyond Ukraine's reporting agency, or user populations beyond Windows desktop users reaching affected sites from search.
CERT-UA observed the activity in September 2026. The source does not give a date for when the campaign began or whether it is ongoing.
The source does not state licensing or tenant configuration requirements. The attack targets Windows users specifically; Mode 2 of the malicious script activates only for Windows visitors arriving from search engine results.
- Check whether Group Policy prohibits standard users from using the Windows Run dialog (
Win+R). CERT-UA advises this control. - Check whether MSI installation is restricted for non-administrator users. CERT-UA advises this restriction.
- Verify that monitoring or alerting exists for
msiexec.exeexecution. CERT-UA advises monitoring this process. - Confirm that Microsoft's vulnerable driver blocklist is enabled to block
PDFWKRNL.sysand similar vulnerable drivers. CERT-UA advises enabling this. - Enable the Defender Attack Surface Reduction rule "Block abuse of exploited vulnerable signed drivers." Microsoft recommends this rule to prevent a vulnerable signed driver from being written to disk.
- Review browser extension policy. CERT-UA advises restricting extension installation to an allowlist. Check whether
FnHotkeyUtility.exeandspkvol.dllappear in endpoint telemetry. - Check endpoint telemetry and Defender logs for
PDFWKRNL.sysload events, Defender exclusion modification events, and unexpected PowerShell-based Native Messaging Host processes. - Review whether proxy or DNS controls can block resolution of domains fetched via Ethereum or Polygon smart contract lookups (EtherHiding). The source does not describe a specific blocking method for this; treat as an investigation point.
- Search installed browser extensions across managed devices for any extension presenting as "Microsoft Office Word Editor" that is not sourced from a known publisher.
My read is that Variant 2 is the most operationally significant path for defender teams. It chains UAC bypass, Defender exclusion modification, and a vulnerable driver load (PDFWKRNL.sys) specifically to neutralize endpoint protection before the stealer payload runs. Organizations that rely on Defender without the vulnerable driver blocklist enabled and without ASR rules active are leaving the most direct evasion path open. The EtherHiding technique for C2 configuration retrieval is also notable: because the attacker-controlled operating mode is stored in a blockchain smart contract, traditional domain blocklisting does not interrupt the initial configuration fetch. Defenders cannot block the Polygon or Ethereum network at the network layer without broader impact, so the more durable control is preventing the initial command execution (Run dialog restriction, MSI install restriction) rather than relying on network-layer blocking of the payload retrieval.
My recommendation is to treat the Run dialog restriction and the vulnerable driver blocklist as the two highest-priority controls if they are not already in place. The Run dialog restriction directly breaks the ClickFix delivery step before any payload runs. The driver blocklist prevents Variant 2 from blinding Defender. Both are documented CERT-UA and Microsoft recommendations. I would also prioritize an extension allowlist review: LUNARAXE persists as a browser extension and strips CSP protections, making it capable of credential theft and arbitrary JavaScript execution across any site the user visits, regardless of how the initial infection was delivered.
The source is a The Hacker News article dated October 7, 2026, reporting on a CERT-UA advisory about the UAC-0277 campaign; it includes CERT-UA's direct quotes and references Arctic Wolf Labs and Ontinue for LunexStealer and LUNARAXE documentation, but does not supply those underlying reports or the original CERT-UA advisory text.