CERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware
ID: da3e8f03-5b76-5da6-806f-60e65c16123b
STIX ID: report--da3e8f03-5b76-5da6-806f-60e65c16123b
Feed Name: Security Affairs
CERT-UA discovered a campaign affecting 100+ compromised websites that display fake Cloudflare verification pages prompting users to run commands (ClickFix) which download MSI installers of LunexStealer. Attackers host configuration in smart contracts on Polygon/Ethereum to control domains and modes, and deploy three MSI variants (direct installer, BYOVD exploit of CVE-2023-20598, and DLL side-loading). LunexStealer steals credentials, can execute arbitrary payloads, may install the LUNARAXE browser extension to exfiltrate cookies and keystrokes, and can use the NAIVEMESS component for filesystem access; CERT-UA recommends avoiding running pasted commands and applying administrative controls and driver/blocking mitigations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.