ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware

CERT-UA reported a campaign in which attackers injected malicious code into more than 100 legitimate websites to display a fake Cloudflare verification page that instructs visitors to run a PowerShell command; executing the command installs Lunex Stealer — an information-stealing malware platform that includes the LunarAxe browser extension and NaiveMess component, can exfiltrate credentials, cookies and crypto wallets, manipulate browsers, access the file system for persistent control, and is being operated as malware-as-a-service targeting Ukrainian-speaking users.