ClickFix Supply‑Chain Attack Compromises 100+ Ukrainian Websites to Deploy Lunex Stealer
What Happened — Attackers injected malicious code into more than 100 Ukrainian web sites. Visitors were shown a counterfeit Cloudflare verification page that instructed them to copy‑paste a PowerShell command, which silently installed the Lunex information‑stealer. The malware harvests passwords, authentication tokens, cryptocurrency wallets and provides remote access to the infected host.
Why It Matters for Trust & Control Assurance
- Illustrates a failure in third‑party content‑integrity controls – a core control objective for supply‑chain risk management.
- Highlights the need for continuous monitoring of external web assets to produce defensible evidence that code has not been tampered with.
- Demonstrates how a single compromised vendor can expose many downstream users, stressing the importance of a documented vendor‑oversight program.
Who Is Affected – Retail/e‑commerce sites, media‑entertainment portals, and any organization that hosts public‑facing web applications in Ukraine (and potentially beyond).
Recommended Actions – Deploy automated integrity‑checking of hosted pages, enforce strict Content‑Security‑Policy (CSP) and code‑signing, and integrate third‑party risk monitoring into your continuous control‑assurance platform. Source: The Record
Technical Notes — Attack vector: malicious script injection leading to a PowerShell command execution (social‑engineering “ClickFix” technique). Malware components: Lunex Stealer, LunarAxe browser extension, NaiveMess payload. Data types stolen: credentials, authentication tokens, crypto‑wallet keys, browsing history, files. Source: The Record