100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
Summary
Over 100 websites have been compromised with malicious JavaScript that delivers the LunexStealer malware, also known as Psychedelic Stealer. This campaign, observed in September 2026 and attributed to the threat cluster UAC-0277, uses fake Cloudflare checks to trick users.
IFF Assessment
The discovery of a new malware campaign distributing information-stealing malware indicates a growing threat to users and organizations, as it enables attackers to compromise sensitive data.
Defender Context
Defenders should be aware of this campaign that leverages compromised websites and fake security checks to distribute stealer malware. It's crucial to ensure endpoint protection is up-to-date and to educate users about recognizing social engineering tactics and verifying security prompts.