Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →More than 100 compromised websites carried a fake Cloudflare verification prompt in September 2026, according to reporting on a CERT-UA analysis of the UAC-0277 campaign. The prompt targeted Windows visitors and tried to trick them into running an MSI installer that delivered LUNEXSTEALER, an information-stealing malware. A real CAPTCHA will not ask you to open Run, PowerShell or Command Prompt and execute a command.
What happened in the UAC-0277 campaign?
CERT-UA, Ukraine’s government computer incident response team, analyzed a campaign tracked as UAC-0277. A contemporaneous technical account of its September 30, 2026 analysis says attackers injected malicious JavaScript into more than 100 compromised websites during September. The figure counts websites—not confirmed victims or infected devices.
As an Amazon Associate I earn from qualifying purchases.
The script reportedly retrieved configuration from a smart contract on Polygon or Ethereum. The contract addresses were not published. It could track visits or display the fake verification page, but the lure was conditional: analysts said it appeared for Windows visitors arriving through a search-engine link who had not seen it more than twice in the previous 12 hours. That filtering can explain why visitors to the same site may see different pages.
The reviewed public reporting does not establish how many people were infected, which sectors were affected, or who was behind the UAC-0277 identifier.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How can you tell the Cloudflare check is fake?
The page imitated Cloudflare’s “I’m not a robot” check, then instructed the visitor to open the Windows Run dialog or a command shell and execute a command. The analyzed commands launched msiexec.exe with a remote MSI URL. CERT-UA categorized this social-engineering approach as ClickFix: the victim is persuaded to perform the action that starts the infection.
The State Service of Special Communications and Information Protection of Ukraine warned, as quoted by UNN on October 6, 2026: “no genuine CAPTCHA or Cloudflare will ask you to open Win+R, PowerShell, or paste commands.” UNN’s report on the warning also relays CERT-UA’s advice to close the page if it asks you to run a command—even if the website is familiar. A familiar site may have been compromised.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Do not open Run, PowerShell or Command Prompt to complete a CAPTCHA.
- Do not paste or type a command supplied by a verification page.
- Close the page if it makes this request; do not try the command to see what it does.
What were the three LUNEXSTEALER installation methods?
The technical account of CERT-UA’s analysis describes three MSI variants. Each ultimately led to LUNEXSTEALER, but the paths differed:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Variant | What the MSI did | Reported technique |
|---|---|---|
| Direct installation | Installed LUNEXSTEALER. | No additional evasion method is specified for this variant. |
| Vulnerable-driver chain | Attempted to bypass Windows User Account Control, added Microsoft Defender exclusions, dropped AMD’s PDFWKRNL.sys driver and then launched LUNEXSTEALER. |
Exploited CVE-2023-20598 to interfere with security tools using a vulnerable signed driver—a bring-your-own-vulnerable-driver (BYOVD) technique. |
| DLL side-loading | Dropped FnHotkeyUtility.exe, which loaded a malicious spkvol.dll; the library decrypted and launched LUNEXSTEALER. |
Used a legitimate executable to load a malicious DLL. |
The technical account identifies CVE-2023-20598 as an improper privilege-management flaw in AMD’s pdfwkrnl.sys kernel driver. It gives the vulnerability a CVSS 3.1 score of 7.8 and lists AMD Adrenalin Edition 23.9.2 and PRO Edition 23.Q4 as fixed releases. These details are reported in that account; they have not been independently verified here against AMD or NVD records.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
In a BYOVD attack, an attacker attempts to load a vulnerable signed driver to gain leverage over security controls. Having a newer driver installed does not, by itself, prevent an attacker from bringing in a vulnerable one. Administrators should verify that the vulnerable-driver blocklist is covered by the policy actually deployed in their environment.
What can LUNEXSTEALER steal or do?
The analysis describes LUNEXSTEALER as a 64-bit Windows infostealer that can also execute remote tasks. Reported targets include:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Passwords and tokens stored by browsers;
- Cryptocurrency wallet data;
- Data from desktop applications; and
- System information.
Depending on server configuration, an infected system may also receive the LUNARAXE browser extension and NAIVEMESS. The extension can appear under the name “Microsoft Office Word Editor,” while NAIVEMESS provides filesystem access to the extension. The report describes these as configuration-dependent components; it does not say every infected device receives them.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat should you do if you ran the command?
If you or someone at work followed the prompt, contact your organization’s security team or incident-response provider and follow its containment process. SOC Prime’s campaign guidance recommends isolating affected hosts when suspicious MSI execution or unauthorized extensions are found. Do not rely on a browser check or an unfamiliar cleanup tool to determine whether the device is safe.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
What should administrators monitor or change?
SOC Prime’s recommendations for this campaign include reducing opportunities for the prompt to succeed and looking for signs of the installer or related components:
- Restrict access to the Windows Run dialog through policy where appropriate.
- Limit who can install MSI packages.
- Enable Microsoft’s vulnerable-driver blocklist and verify the policy is active on managed systems.
- Allowlist browser extensions and investigate unauthorized additions, including an extension named “Microsoft Office Word Editor.”
- Monitor
msiexec.exeexecutions that reference remote URLs.
The technical account also mentions a scheduled task written with differing capitalization in secondary reporting (psychedelicLoveUtils and psychedelicloveUtils). Verify exact indicators against the official advisory before turning them into production detection rules; the reviewed reporting does not establish which spelling should be used as a definitive indicator.
How can a website owner respond?
If your site displays an unexpected verification page or visitors report being told to run commands, treat it as a possible compromise. CERT-UA’s reporting says the team asked to be notified about fake pages and offered site owners help investigating compromised sites. For organizations outside Ukraine, contact the appropriate national or sector incident-response team as well as your hosting provider.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
