News summary · Threat Intelligence

CERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware

Reported by Security Affairs (Pierluigi Paganini)

Summary by Cyber Security News7 Oct 2026, 15:22 CET

About this summary. This is a short excerpt from the description that Security Affairs published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://securityaffairs.com/200537/hacking/cert-ua-fake-cloudflare-checks-deliver-lunexstealer-malware.html

CERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware — Image: Security Affairs

Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through ClickFix commands. The lure is the now-familiar ClickFix technique, dressed up as Cloudflare’s standard bot check. The fake page asks you to run a command, supposedly to confirm you’re not a bot, and that command quietly downloads and installs an MSI package from an attacker-controlled server.

Read the full article at Security Affairs →

Source attribution: headline and facts are from Security Affairs (securityaffairs.com). Summary method: excerpt of the source description. See our source attribution policy.