LUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome Extension

An active campaign used malicious JavaScript injected into >100 legitimate websites to present fake Cloudflare verification pages that trick Windows visitors into running a command to download and install MSI droppers for LUNEXSTEALER. Multiple delivery chains (direct MSI, UAC-bypass loader with a vulnerable driver CVE-2023-20598, DLL side‑loading) lead to a stealer that exfiltrates cookies, credentials, crypto-wallet data, and enables remote JavaScript execution and filesystem access via the LUNARAXE browser extension and NAIVEMESS native messaging; CERT-UA published IOCs and mitigation guidance.