Over 100 Ukrainian Websites Hijacked to Serve Lunex Stealer via Fake Cloudflare Checks
What Happened — Attackers breached more than 100 Ukrainian web sites and replaced legitimate Cloudflare verification pages with malicious JavaScript. The fake “check” delivers the Lunex Stealer, which harvests browser passwords, authentication tokens and cryptocurrency wallet keys from any visitor who interacts with the page.
Why It Matters for Trust & Control Assurance
- Demonstrates a supply‑chain risk where compromised third‑party web assets become a delivery vector for credential‑stealing malware.
- Highlights the need for continuous integrity monitoring of external sites and immutable evidence of remediation to satisfy audit requirements.
- Shows that without documented change‑control logs, organizations lack a defensible trail to prove they detected and responded to the breach.
Who Is Affected — Web‑hosting providers, site owners, and any organization whose customers or employees browse the compromised Ukrainian domains (across all industry verticals).
Recommended Actions
- Deploy real‑time file‑integrity monitoring and Content‑Security‑Policy (CSP) controls for all public web assets.
- Capture and retain change‑management logs and web‑server configuration snapshots as audit evidence.
- Review and extend third‑party risk policies to include website supply‑chain controls, incident‑response playbooks, and continuous verification of external assets. Source: https://hackread.com/ukrainian-websites-hacked-lunex-stealer-clickfix/
Technical Notes — The malicious script masquerades as a Cloudflare JavaScript challenge, tricking browsers into executing the payload. Lunex Stealer extracts saved passwords, session tokens and private keys from browsers and crypto wallets, then exfiltrates them to attacker‑controlled C2 servers. No specific CVE was disclosed; the compromise appears to stem from inadequate web‑server hardening and lack of integrity checks. Source: https://hackread.com/ukrainian-websites-hacked-lunex-stealer-clickfix/