Ukraine’s Computer Emergency Response Team has discovered over 100 compromised websites distributing LunexStealer, an information-stealing malware, through fake Cloudflare verification pages. The threat group UAC-0277 injected malicious JavaScript into these sites, which displayed forged verification prompts to Windows users arriving from search engines. When visitors executed the prompted commands, malicious MSI packages were downloaded and installed using the ClickFix technique. The attackers used the EtherHiding technique to retrieve configuration details from blockchain smart contracts on Polygon or Ethereum networks, allowing them to control whether sites tracked visitors or displayed the fake pages.
Three MSI package variants were identified, with increasingly sophisticated evasion methods including Windows account control bypass, Microsoft Defender exclusion configuration, and DLL sideloading. Once installed, LunexStealer deploys LUNARAXE, a malicious browser extension disguised as “Microsoft Office Word Editor” that steals cookies, browsing history, and credentials. An auxiliary component called NAIVEMESS provides file system access through PowerShell. Security recommendations include restricting MSI installation permissions, monitoring for suspicious processes, blocking vulnerable drivers, and limiting browser extensions to approved lists.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
