Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →CERT-UA reported that attackers compromised more than 100 legitimate websites in September 2026 and used a fake Cloudflare check to trick some visitors into running a command that installed the Lunex Stealer malware. The figure counts websites—not infected computers or confirmed victims. CERT-UA has not disclosed successful infection totals or identified the affected site owners.
How the ClickFix campaign worked
In its September 30, 2026 advisory, CERT-UA tracked the activity as UAC-0277. Malicious JavaScript injected into legitimate websites could display a counterfeit “I am not a robot” verification prompt. Instead of completing a normal browser check, the visitor was told to execute a command. That command downloaded and installed a Windows MSI package from a remote server. CERT-UA classifies this kind of command-prompting lure as ClickFix.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
5-in-1 Win Repair & Reinstall Bootable USB Flash Drive – Fix, Recover, or Reinstall Windows 11... | $24.99 | Buy on Amazon |
| 2 |
|
Tech Core 31-in-1 Multi-Boot USB Toolkit for IT Pros | $36.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
The prompt was selectively shown
The verification prompt was not shown to every visitor. In the campaign’s mode 2, it was presented only to Windows users who had arrived through a search engine, and at most twice within a 12-hour period. The script obtained its operating mode and the domain used for the fake check from a smart contract on Polygon or Ethereum. According to CERT-UA, this gave the operators a way to change the mode or domain centrally without updating each compromised website.
What the three MSI variants did
CERT-UA examined three MSI variants. They shared the goal of delivering Lunex, but used different installation techniques:
#1 Best Overall
- Dual USB-A & USB-C Bootable Drive – compatible with nearly all Windows PCs, laptops, and tablets (UEFI & Legacy BIOS). Works with Surface devices and all major brands.
- Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
- Complete Windows Repair Toolkit – includes tools to remove viruses, reset passwords, recover lost files, and fix boot errors like BOOTMGR or NTLDR missing.
- Reinstall or Upgrade Windows – perform a clean reinstall of Windows 7 (32bit and 64bit), 10, or 11 (amd64 + arm64) to restore performance and stability. (Windows license not included.). Includes Full Driver Pack – ensures hardware compatibility after installation. Automatically detects and installs drivers for most PCs.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
- Direct installation: One package installed Lunex Stealer directly.
- Privilege and driver abuse: Another attempted to bypass Windows User Account Control, add exclusions to Microsoft Defender, and exploit the vulnerable AMD driver PDFWKRNL.sys using CVE-2023-20598, a bring-your-own-vulnerable-driver technique (BYOVD), before retrieving Lunex.
- DLL side-loading: A third used a legitimate FnHotkeyUtility.exe to load a malicious spkvol.dll, which decrypted and launched the stealer.
These are behaviors CERT-UA documented in the analyzed variants; they do not establish that every package or infection used every technique.
What Lunex Stealer can access
CERT-UA describes LUNEXSTEALER as 64-bit Windows malware that combines information theft with remote task execution. Its documented capabilities include stealing saved browser passwords and tokens, desktop and browser cryptocurrency-wallet information, and system details. It can also download and run executables, MSI packages, PowerShell scripts, and commands through cmd.exe.
Optional browser-extension capabilities
Depending on its configuration, Lunex can install LUNARAXE, a malicious Chromium-based extension that presents itself as “Microsoft Office Word Editor.” The extension can steal cookies, browsing history, and credentials entered into web forms; run JavaScript remotely on pages; control tabs; capture images of tabs; and change proxy settings.
When the NAIVEMESS component is present, the extension can also access Windows file-system functions, including listing drives and directories, reading and writing files, and launching files. These are documented capabilities, not evidence that every compromised device received the extension or all of its components.
What to do if a site asks you to run a command
Do not follow the instruction. CERT-UA’s warning is unambiguous: a legitimate “I am not a robot” check does not require you to press Win+R, open Command Prompt or PowerShell, or paste and execute a command. Close the page—even if the site is familiar. Do not run the command to see what it does.
Rank #2
- Supports UEFI and Legacy BIOS boot on many PCs and laptops. If boot issues occur, check Secure Boot settings and use the included boot instructions.
- Complete All-in-One Dual USB-A & USB-C System Toolkit – boot, repair, recover, reinstall, reset forgotten Windows or Linux passwords, restore files, access locked systems, run LIVE/install best Linux OS systems - all from one ultra-fast 128 GB USB 3.0 drive loaded with premium Linux and Windows utilities.
- Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
- Powered by the most powerful Multi-Boot Manager – easily launch dozens of OS and recovery tools without reformatting. Works with laptops, desktops, mini-PCs, Windows tablets and other modern USB-C devices — no adapters or setup required.
- Includes 31+ OS & Utilities (x86-64 & ARM64) – Linux Ubuntu, Kali, Mint, Tails, retro-gaming emulator - Batocera (ready to play), Garuda, Fedora, openSUSE, Solus, CAINE Digital Forensics, 3D printing and engineering Linux OS, Windows Installers, DriverPacks, Antivirus Rescue Disks, and much more!
If you only saw the prompt
Close the page without executing anything. The presence of a compromised website or a displayed prompt does not by itself prove that your computer was infected: CERT-UA says the lure had specific targeting conditions and required the visitor to run a command.
If you ran the command
Treat the device as potentially compromised. Stop using it for sensitive work, and contact your organization’s IT or security team if it is a work device. Tell them what you clicked or executed and when; keep any details you still have about the page, command, or downloaded file. CERT-UA’s advisory does not provide a confirmed infection count or establish that every person who ran a command had data stolen, so an individual device needs assessment rather than assumptions.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsControls CERT-UA recommends for administrators
CERT-UA recommends reducing the opportunity for command execution and limiting what a successful installer or extension can do. Its listed measures are:
- Restrict the Run function for ordinary users through Group Policy.
- Limit MSI installation by users without administrator rights.
- Monitor
msiexec.exe, especially when its command line contains a URL. - Enable Microsoft Vulnerable Driver Blocklist.
- Restrict browser-extension installation to an approved list.
The advisory does not name the affected website owners or disclose how many computers were successfully infected. The “100+” figure should therefore be read strictly as CERT-UA’s count of compromised websites identified during September 2026.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
