Cybersecurity threats involve LunexStealer malware and forged Cloudflare checks

Cybersecurity researchers have identified a campaign involving over 100 compromised websites used to distribute LunexStealer, also known as Psychedelic Stealer. The Computer Emergency Response Team of Ukraine (CERT-UA) reported that the threat cluster UAC-0277 utilizes malicious JavaScript to present users with forged Cloudflare verification pages. Under the guise of confirming the visitor is human, these pages prompt users to execute commands that download and install malicious MSI packages via the ClickFix technique.

The malware utilizes the EtherHiding technique, retrieving domain names and operating modes from smart contracts on the Polygon or Ethereum networks. The campaign features three modes: inactive, passive tracking of visitor data, and the display of fake verification pages. The latter is specifically targeted at Windows users arriving from search engine results.

In a broader context of recent cyber threats, security analysts have noted a variety of vulnerabilities, including malicious code in developer packages, phishing emails leveraging familiar online services, and the use of AI assistants in phishing messages. These incidents highlight a trend where both attackers and target systems exhibit lapses in security, ranging from exposed hacker tools to weak session cookies and design flaws.