CERT-UA found fake Cloudflare verification pages that led visitors into a now-familiar ClickFix trap. This time the goal was to infect machines with an infostealer.
ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware
About this summary. This is a short excerpt from the description that The Record published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://therecord.media/clickfix-campaign-ukraine-lunex-stealer
Source attribution: headline and facts are from The Record (therecord.media). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Inside ICMacOS: From an Infostealer to a Persistent RAT
Inside ICMacOS: From an Infostealer to a Persistent RAT Over the past few years, Apple’s enterprise footprint has expanded significantly, with macOS capturing an…
CastleStealer: An Emerging Infostealer Growing More Sophisticated
Table Of ContentsTable of ContentsWhat We Know About CastleStealerWhat Data Does CastleStealer Target?Bypassing App-Bound EncryptionFrom Infostealer to Remote AccessHow…
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN…
CERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware
Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through ClickFix commands. The lure is the now-familiar ClickFix…
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 117
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Lunex Unmasked…
Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net
The APT actor is using a new tactic, dubbed "RedFlick," against Ukrainian-linked targets such as NGOs, think tanks, and journalists to deploy its CosmicPulse backdoor.