You are browsing the web, searching for information for your work. A result appears, and you click on it. The page loads slower than usual, and then a familiar dialog box pops up: "Please verify you are a human." You have seen this screen thousands of times—it is Cloudflare, the familiar shield protecting millions of websites. Without a second thought, you follow the instructions.
And that is precisely the moment you just handed the keys to your computer over to an attacker.
A sophisticated attack campaign is currently underway on a massive scale, and it does not target the uneducated. It targets trust—the trust we place in familiar tech brands like Cloudflare. Let's break down how this campaign works, because understanding it clearly is the first step to protecting yourself.
Large-Scale Attack Campaign: Over 100 Compromised Websites
The Computer Emergency Response Team of Ukraine (CERT-UA) has discovered over 100 compromised websites injected with malicious JavaScript code. This campaign was observed in September 2026 and has been attributed to a threat actor group known as UAC-0277.
The scariest part is not the number of compromised websites. The scariest part is the attack method. The attackers created a fake Cloudflare verification page—perfectly replicating the interface that billions of internet users have learned to trust. This fake page displays the familiar message: "Please verify you are a human." But instead of simply clicking a checkbox, users are instructed to execute a command—an action that any security expert would immediately recognize as a major red flag.
When the victim complies, a malicious MSI package is downloaded and installed from a remote server. This technique is known as ClickFix—an increasingly popular attack method that exploits user behavior to bypass automated defenses.
EtherHiding: When Blockchain Becomes a Tool for Cybercriminals
What makes this campaign particularly dangerous is the use of the EtherHiding technique. The attackers store the domain name of the fake verification page and the operational mode of the script inside a smart contract on the Polygon or Ethereum network.
Why is this important? Because blockchain smart contracts are immutable. Once deployed, they cannot be modified or removed by any authority. This means the attacker's infrastructure cannot be taken down through traditional means. Security researchers can detect it, but they cannot switch it off.
According to CERT-UA, the malware operates in three modes:
- Mode 0: Inactive.
- Mode 1: Passive monitoring – collects data about the website and the referring page.
- Mode 2: Displays the fake verification page.
Notably, in Mode 2, the fake page is only displayed to Windows users arriving from search results, and no more than twice in 12 hours. This is a sophisticated tactic to avoid detection—if someone visits repeatedly, they won't see the fake page, making investigation much more difficult.
Three MSI Variants: From Simple to Sophisticated
The attack does not stop at tricking users into running commands. Researchers have discovered at least three variants of the malicious MSI package, each with varying levels of sophistication:
Variant 1: Installs LunexStealer directly onto the system. This is the simplest option, but also the easiest to detect.
Variant 2: Attempts to bypass Windows User Account Control (UAC), configures Microsoft Defender exclusions, and exploits a valid but vulnerable AMD driver ("PDFWKRNL.sys") to disable security software. It then downloads and runs LunexStealer from a remote server.
Variant 3: Launches LunexStealer via DLL sideloading – using a legitimate binary ("FnHotkeyUtility.exe") to load a malicious DLL ("spkvol.dll"), which then decrypts and executes the stealer. This is the most sophisticated technique, making it hard to detect by traditional security solutions.
LunexStealer: The Comprehensive Data Thief
Once it successfully infiltrates the system, LunexStealer gets to work. And this is no simple piece of malware.
LunexStealer is designed to install a malicious browser extension named LUNARAXE, disguised under the guise of "Microsoft Office Word Editor" – a harmless and trustworthy-sounding name.
This extension is capable of:
- Stealing cookies, browsing history, and login credentials entered into web forms.
- Allowing attackers to remotely control the browser and execute arbitrary JavaScript on web pages.
But that is not all. LunexStealer also deploys a secondary component named NAIVEMESS, installed based on configuration received from the command and control (C2) server. This component grants LUNARAXE access to the Windows file system via a PowerShell-based Native Messaging Host.
CERT-UA describes the capabilities of NAIVEMESS: "NAIVEMESS functionality includes retrieving disk lists, browsing directories, reading, creating, and overwriting files, as well as executing them." Files are transferred in Base64-encoded chunks, and directories along with groups of files are compressed into ZIP archives beforehand.
The LUNARAXE extension contains three additional modules:
- LUNARAXE.CORE: Handles C2 communication, receives and executes commands, extracts browser data (cookies, history, bookmarks, installed extension info, blocked login info). It can also manage tabs, toggle extensions, display notifications, run JavaScript on web pages, and show fake overlays.
- LUNARAXE.STEALER: Gathers credentials entered into web forms and sends them to LUNARAXE.CORE, along with the page URL.
- LUNARAXE.STRIP: Disables Content Security Policy (CSP) protections on web pages by removing CSP headers from HTTP responses, aiming to run arbitrary JavaScript code.
How to Protect Yourself: Steps You Need to Take Today
Facing such a sophisticated attack campaign, feeling helpless is understandable. But do not worry – there are concrete steps you can take to minimize risk.
1. Never Run Commands From Verification Dialogs
This is the golden rule. The real Cloudflare never asks you to open the Run dialog and paste a command. If you see such a request, close the tab immediately. No exceptions.
2. Restrict Standard User Permissions
CERT-UA recommends organizations prohibit standard users from using the Windows Run dialog via group policy, and restrict MSI package installation for users without administrative privileges.
3. Monitor the Execution of msiexec.exe
Monitoring suspicious msiexec.exe processes can help detect malicious software installation attempts early.
4. Block Vulnerable Drivers
Enable Microsoft's vulnerable driver blocklist and turn on the Attack Surface Reduction (ASR) rule named "Block abuse of exploited vulnerable signed drivers" to prevent applications from writing signed yet vulnerable drivers to disk.
5. Limit Browser Extension Installations
Only allow the installation of browser extensions from an approved list. This prevents malicious add-ons like LUNARAXE from invading your browser.
6. Update and Patch Regularly
Keep your operating system, browser, and security software up to date. Attackers frequently exploit known but unpatched vulnerabilities.
When Trust Becomes a Vulnerability
I have witnessed the security industry change dramatically over the past two decades. From simple viruses spreading via floppy disks to targeted attacks aiming at critical infrastructure. But never have I seen a campaign exploit trust so blatantly and effectively.
Cloudflare is one of the most trusted security companies in the world. Billions of users see their verification screen every day. And attackers have turned that very familiarity into a weapon.
The lesson here is not just "don't run strange commands." The deeper lesson is: in the digital world, trust must go hand in hand with vigilance. Even the brands you trust the most can be impersonated. Even the most familiar-looking dialog boxes can be traps.
Protect yourself, protect your family, and protect your organization. Because in the fight against cybercrime, knowledge is the most powerful shield.
Have you ever encountered a fake verification page like this? And if so, how would you handle the situation – close the tab immediately, or would you be curious and follow the instructions to "see what happens"? Share your experience below, because in the fight against increasingly sophisticated attackers, everyone's experience is a brick building a shared defense wall!
0 Comment
Add your comment to this article