Ukraine's computer emergency response team, CERT-UA, has uncovered a campaign that compromised more than 100 legitimate websites to show visitors fake security checks and infect them with an info-stealer called Lunex, The Record reported Tuesday. The activity, aimed at Ukrainian and Ukrainian-speaking users, relies on the ClickFix technique, in which victims are coaxed into running the malicious command themselves.

What Happened

CERT-UA said it detected the campaign in September and tracks it under the label UAC-0277. The hijacked sites were ordinary businesses and hobby pages, including an online store and a site offering coloring pages for children.

Visitors to those sites were shown a page imitating a Cloudflare verification check. Instead of clicking a box, they were told to copy a command and paste it into PowerShell to prove they were human. Running it installed the malware.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Lunex is offered as malware-as-a-service, meaning its developers rent it to separate criminal customers rather than running every operation themselves. It harvests saved passwords, authentication tokens and cryptocurrency wallet data and gives the operator remote access to the infected computer.

How the Malware Works

Part of the package is a browser extension CERT-UA calls LunarAxe, which disguises itself as a "Microsoft Office Word Editor." It steals cookies, browsing history and stored website credentials and gives the attackers broad control over the browser. It targets seven Chromium-based browsers: Chrome, Edge, Brave, Yandex, Opera, Opera GX and Vivaldi.

A second component, NaiveMess, works alongside the extension to reach the computer's file system, letting operators browse directories, change files and launch programs.

CERT-UA found 28 Lunex operator panels hosted in 13 countries. The panel software uses Russian as its default language, and the agency assessed that the developers are Russian speakers. The Record said Lunex has also been used for credential theft and phishing that impersonates well-known brands.

Why It Matters

ClickFix works because the user, not an exploit, executes the code. A command pasted into PowerShell by the victim can get past controls built to catch malicious downloads or document macros, and the fake Cloudflare page borrows the look of a check most internet users have seen many times. Since the technique surfaced in 2024, security researchers have documented both criminal crews and state-linked groups adopting it. The Primary Wire also reported recently on fake ChatGPT custom GPTs being used to steer searchers into a ClickFix infection chain.

Using more than 100 everyday websites as bait widens the net beyond targeted phishing. Anyone who lands on a compromised page through search or a link can be exposed, and the stolen browser sessions and tokens can let attackers into accounts without needing a password.

CERT-UA did not attribute the campaign to any known group and did not say how many computers were infected. Because Lunex is rented to multiple buyers, the panels it found may belong to unrelated operators.

What to Watch

Open questions include whether CERT-UA or other researchers link UAC-0277 to an established Russian-speaking group, how many Ukrainian users were infected, and whether the compromised websites have been cleaned. Organizations can reduce exposure by restricting PowerShell for ordinary users and by auditing installed browser extensions for unfamiliar entries such as a supposed Word editor.