Over 100 Websites Compromised with Fake Cloudflare Checks to Deploy LunexStealer Malware
What Happened — CERT‑UA disclosed that more than 100 public‑facing websites were injected with malicious JavaScript. The code displays a counterfeit Cloudflare “checking your browser” page, then redirects visitors to the LunexStealer (aka Psychedelic Stealer) payload that harvests credentials, cookies and other sensitive data.
Why It Matters for Trust & Control Assurance
- The attack demonstrates a gap in continuous verification of web‑application code integrity – a control objective that continuous‑monitoring programs are built to protect.
- Without immutable evidence of the exact state of each web asset, organizations cannot produce a defensible audit trail showing timely detection and remediation.
- Mapping this incident to a control‑assurance framework highlights the need for automated integrity checks, CSP/SRI policies, and evidence collection that can be presented in a Trust Center.
Who Is Affected — Any organization that hosts public‑facing web applications, including SaaS providers, e‑commerce sites, media portals, and corporate marketing pages.
Recommended Actions
- Inventory all internet‑facing domains and enable file‑integrity monitoring (FIM) for HTML/JS assets.
- Enforce Content‑Security‑Policy (CSP) and Subresource Integrity (SRI) to block unauthorized scripts.
- Run regular automated scans for injected JavaScript and anomalous redirects.
- Document detection, response, and remediation steps as evidence for control‑assurance reviews. Source: The Hacker News
Technical Notes
- Attack vector: malicious JavaScript delivered via a fake Cloudflare challenge page.
- Payload: LunexStealer (information‑stealing malware) that exfiltrates credentials, session cookies and browser data.
- Observed: September 2026; attributed to threat cluster UAC‑0277. Source: The Hacker News