// CloudflareMEDIUM
Hackers compromised over 100 websites and deployed malicious JavaScript that displays fake Cloudflare verification pages to distribute LUNEXSTEALER malware. The campaign, tracked by CERT-UA as UAC-0277 and identified in September 2026, exploits users' trust in Cloudflare security checks. The malware steals browser passwords, authentication tokens, cryptocurrency wallet data, and system information, and supports remote command execution. Attackers abused the legitimate Cloudflare brand to increase effectiveness of social engineering.
// Get alerts for Cloudflare