100+ Ukrainian Websites Hacked to Install Lunex Stealer with ClickFix Lure

More than 100 Ukrainian websites were compromised to display fake Cloudflare verification prompts that instruct visitors to open Windows tools and run commands which download and install the Lunex infostealer (a ClickFix social-engineering lure). Lunex harvests browser credentials, cookies, payment-card and crypto-wallet data, can install a malicious Chromium extension (LunarAxe) and native messaging component (NaiveMess) for persistence, and its loader abuses a vulnerable AMD driver (CVE-2023-20598) to bypass endpoint security; CERT‑UA is tracking the campaign as UAC-0277.