In September 2026, Ukraine’s CERT-UA identified more than 100 compromised websites carrying malicious JavaScript linked to a ClickFix campaign. Visitors were shown a fake Cloudflare verification page and urged to run a command themselves; that action could download and install malware. The reported payload, Lunex Stealer, can steal credentials and cryptocurrency wallet data. The count refers to websites—not infected computers.
What happened in the ClickFix campaign?
CERT-UA’s September 30 advisory identified more than 100 compromised websites with malicious JavaScript added to their pages. The agency labeled the activity UAC-0277. The advisory’s website count does not establish how many visitors encountered the lure or how many devices were infected. CERT-UA advisory (Ukrainian)
As an Amazon Associate I earn from qualifying purchases.
According to The Record’s October 6 report, the injected script displayed a counterfeit Cloudflare check and presented a PowerShell command as a way to prove the visitor was human. Running it led to an MSI download and installation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What does the fake Cloudflare page ask you to do?
It asks you to copy or otherwise run a command on your device. That request—not simply viewing the compromised page—is the crucial step in the reported delivery chain. A CAPTCHA or human-verification check should not require you to paste a command into PowerShell or another system tool.
#1 Best Overall
ClickFix is the name commonly used for this social-engineering pattern: a fake error or verification step persuades someone to execute a command. It is not, in this reported incident, described as a browser flaw that automatically infects a device just because someone visits a page.
- Do not copy commands from a webpage to pass a CAPTCHA or prove you are human.
- Do not assume a familiar or legitimate-looking website is safe; a site can be compromised.
- If a page asks you to run a command, close it and report it through the site’s official support or security channel.
What can Lunex Stealer do?
The Record says Lunex can steal passwords, authentication tokens, and cryptocurrency wallet data, and can provide remote access. These are reported capabilities; they do not mean every visitor or every infection experienced each effect.
The Record also reports that Lunex installs a malicious browser extension called LunarAxe in some cases. Disguised as “Microsoft Office Word Editor,” the extension can access cookies, browsing history, and credentials entered on websites. The reported capabilities also include manipulating tabs, running JavaScript on webpages, taking screenshots, and changing proxy settings.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A further component, NaiveMess, is described as enabling LunarAxe to reach the filesystem, browse directories, read or overwrite files, and execute programs. These components and capabilities are reported for associated activity; the reporting does not establish that they were present in every infection from the campaign.
Rank #3
What does separate Lunex research add?
Ontinue Cyber Defence Centre’s September 24 technical analysis examines a related Lunex infection chain targeting Ukrainian-speaking users. It describes multiple infection stages, credential and cryptocurrency-wallet theft, bring-your-own-vulnerable-driver (BYOVD) activity, and persistent remote filesystem access through a PowerShell-based Native Messaging Host. Its findings provide technical context about related Lunex activity, but do not establish that the analyzed sample or infrastructure was identical to every infection in the September campaign. Ontinue’s Lunex analysis
Ontinue also reports that its internet-wide scan found 28 Lunex panels across 13 countries. Those are observations about Lunex-platform infrastructure, not counts of compromised Ukrainian websites or campaign victims. Its analysis lists seven Chromium-based browsers targeted by the sample it examined: Chrome, Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi. That is a finding about that sample, not a compatibility claim for every Lunex version.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is known—and not known—about the impact?
CERT-UA reported more than 100 compromised websites, but the cited reporting does not state how many computers were infected or identify the campaign’s victims. The Record says CERT-UA did not attribute the activity to a known group. UAC-0277 is CERT-UA’s identifier for the activity, not a public attribution to a named actor.
Do not treat the website total as an infection estimate: the sources do not establish how many visitors saw the fake page, ran the command, or received each reported malware component.
Best Value
If you ran the command, what should you do?
Because the reported capabilities include credential, token, wallet, browser-data, and file access, treat a device where the command was run as potentially compromised. The cited incident reports do not provide a complete cleanup or recovery procedure, so avoid assuming that one action—such as changing a password—removes malware or invalidates every stolen session.
Quick Recap
- If the device belongs to an employer or school, contact its IT or security incident-response team promptly and follow their instructions.
- For a personal device, seek help from a qualified security professional. Avoid using the potentially compromised device to sign in to sensitive accounts until you have received guidance.
- From a separate, trusted device, contact your bank or cryptocurrency provider if financial accounts or wallet data may be involved. Ask about securing accounts and reviewing or revoking active sessions and tokens.
- Preserve the page address and any relevant alert or command details for responders, but do not run the command again.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
