100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

CERT-UA reported that over 100 compromised websites were injected with malicious JavaScript to deliver LunexStealer (Psychedelic Stealer) using forged Cloudflare verification pages and EtherHiding; attackers distributed MSI installers (three variants) that employ UAC bypass, a vulnerable AMD signed driver exploitation, and DLL sideloading to install the LUNARAXE browser extension and NAIVEMESS native messaging host for credential, cookie, browsing-history and file exfiltration, and advised restricting MSI installs, blocking vulnerable drivers, monitoring msiexec, and limiting browser extensions.