Fake Cloudflare Bot Checks Used to Distribute LunexStealer Malware on Over 100 Compromised Websites
What Happened – In September 2026 CERT‑UA identified more than 100 web sites that had been injected with malicious JavaScript. The script displayed a counterfeit Cloudflare “I’m not a bot” page and prompted visitors to run a command. The command silently downloaded an MSI installer that deployed the LunexStealer malware family. The campaign is controlled via a smart‑contract on Polygon/Ethereum, allowing attackers to switch domains or toggle the attack without touching the compromised pages.
Why It Matters for Trust & Control Assurance
- Demonstrates how a lack of continuous integrity monitoring lets attackers hide malicious code on production sites for months.
- Highlights the need for auditable evidence that web‑application controls (code‑signing, script‑allow‑list, bot‑challenge integrity) are continuously enforced and verified.
- Shows that third‑party risk (hosting providers, CDN configurations) must be documented and re‑validated to maintain a defensible audit trail.
Who Is Affected – Organizations that host public‑facing web applications or rely on third‑party CDNs (e.g., SaaS platforms, e‑commerce sites, media portals).
Recommended Actions
- Deploy file‑integrity monitoring or runtime application self‑protection (RASP) to detect unauthorized script changes.
- Enforce strict code‑signing and CSP (Content‑Security‑Policy) rules that block inline script execution from unknown origins.
- Review and document third‑party CDN and hosting contracts; add continuous verification of their security controls to your audit evidence.
Technical Notes – The attack uses a “ClickFix” command‑execution technique, delivering an MSI that either (1) bypasses Windows UAC, (2) creates Defender exclusions and exploits CVE‑2023‑20598 via a vulnerable AMD driver (BYOVD), or (3) performs DLL side‑loading. The malicious page is served only twice per 12 hours per visitor to evade traffic‑anomaly detection. Source: https://securityaffairs.com/200537/hacking/cert-ua-fake-cloudflare-checks-deliver-lunexstealer-malware.html