ClickFix Campaign Compromises 100+ Ukrainian Websites to Spread Lunex Malware

More than 100 legitimate websites in Ukraine have been compromised in a broad social engineering operation utilizing the ClickFix delivery mechanism to distribute Lunex malware. Tracked by CERT-UA under the threat actor designation UAC-0277, the activity relies on injecting malicious code into vulnerable websites to display fake Cloudflare verification prompts. When users attempt to pass the fake “verify you are human” check, they are instructed to copy a malicious command and run it directly in Windows PowerShell, unwittingly downloading and installing the Lunex Stealer infostealer.

First detected in September, the operation targets a wide spectrum of Ukrainian web properties, including e-commerce platforms and a children’s coloring page site. Cybersecurity firm Ontinue has tracked overlapping Lunex activity, pointing to a modular Malware-as-a-Service (MaaS) platform designed for credential theft, session hijacking, and persistent system access.

The ClickFix Attack Pattern

The campaign relies on site-level compromise, typically accomplished by exploiting vulnerable Content Management Systems (CMS), outdated web plugins, or stolen webmaster credentials. Once inside, attackers inject scripts that intercept traffic and render overlay elements masquerading as Cloudflare’s Turnstile or CAPTCHA verification frames.

Because web browsers have significantly tightened security around automated file downloads, threat actors are increasingly abandoning drive-by download exploits in favor of execution vectors where the victim performs the execution manually. ClickFix leverages psychological conditioning: users are accustomed to completing verification prompts to access content.

The fake Cloudflare interface copies a pre-formatted PowerShell snippet into the victim’s clipboard and instructs them to press Win + R, open PowerShell, and paste the code. Because the command executes natively within the user’s privileged context, it bypasses traditional browser download protections, web reputation filters, and initial SmartScreen checks. The obfuscated PowerShell script retrieves the primary Lunex executable from remote command-and-control (C2) infrastructure and executes it in memory or drops it into temporary system directories.

Modular Capabilities: Lunex, LunarAxe, and NaiveMess

Once deployed, the primary Lunex payload initiates an automated reconnaissance and harvest routine. The malware is written to extract authentication tokens, stored credentials, session cookies, autofill data, and cryptocurrency wallet information. It specifically targets seven Chromium-based web browsers:

• Google Chrome
• Microsoft Edge
• Brave
• Yandex Browser
• Opera
• Opera GX
• Vivaldi

Beyond immediate data exfiltration, the malware establishes persistent foothold mechanisms on the infected host through secondary payloads:

1. LunarAxe Browser Extension: Lunex installs a rogue extension disguised as “Microsoft Office Word Editor” into Chromium browsers. Once loaded, LunarAxe monitors active browsing sessions, captures keystrokes, manipulates open tabs, executes arbitrary JavaScript within the context of active web pages, captures screenshots, and modifies browser proxy settings to intercept traffic.
2. NaiveMess Tooling: Working alongside LunarAxe, the NaiveMess component elevates the browser extension’s capabilities into full-system file management. It grants operators remote administrative access to the underlying file system, allowing attackers to browse directory trees, read, overwrite, and download local files, and execute secondary programs.

Crucially, because LunarAxe and NaiveMess function as persistent browser-level background processes, attacker access to the host’s file system and active web sessions often remains fully functional even if the original Lunex executable is identified and removed by endpoint security software.

Threat Actor Profile and MaaS Ecosystem

While CERT-UA tracks this specific Ukrainian campaign under identifier UAC-0277 without formal attribution to a known group, technical analyses indicate that Lunex is operated as a commercial Malware-as-a-Service platform. Developed by Russian-speaking operators, the service is rented out to independent cybercriminals who manage their own distribution vectors and targets.

Researchers identified 28 distinct Lunex operator control panels hosted across 13 countries. The administrative backend defaults to Russian and relies heavily on Russian-language interface components. The platform remains under active development, regularly updating its evasion techniques and expanding its feature set for credential theft and brand impersonation campaigns.

Blast Radius and Operational Risk

The blast radius for this campaign spans both consumer and enterprise environments. Because the injected websites include high-traffic public resources—such as retail stores and family-oriented sites—the initial infected population consists largely of general internet users.

However, in corporate and government settings, user-driven infection vectors pose an immediate threat to boundary security. An employee browsing a compromised site from a corporate-managed or personal BYOD Windows machine can compromise enterprise network perimeters within seconds. Session tokens stolen from browsers allow attackers to bypass multi-factor authentication (MFA) on corporate portals, webmail, and cloud environments (such as Microsoft 365 or AWS). Furthermore, the persistent remote execution capabilities provided by LunarAxe and NaiveMess allow affiliates to use infected endpoints as initial access vectors for secondary network discovery, lateral movement, and ransomware deployment.

Detection and Hardening

Mitigating ClickFix campaigns requires restricting native command-line tool usage for standard users and monitoring browser extension installs:

• PowerShell Hardening: Implement AppLocker or Windows Defender Application Control (WDAC) to restrict script execution. Enforce PowerShell Constrained Language Mode for standard non-administrative accounts to prevent arbitrary API calls and execution of inline base64 scripts.
• Command-Line Auditing: Enable Windows Event Forwarding for Event ID 4104 (PowerShell Script Block Logging). Configure SIEM rules to alert on PowerShell invocations containing download cradles, such as Invoke-Expression (IEX), Net.WebClient, or Start-BitsTransfer launched directly following user clipboard interactions.
• Browser Extension Policies: Enforce Group Policy Objects (GPO) or Administrative Templates in Chrome and Edge (ExtensionInstallBlocklist) to restrict extension installations strictly to an explicit allowlist. Hunt for unauthorized extensions matching the public name “Microsoft Office Word Editor” or displaying atypical permissions (such as access to all website data and native messaging host integration).
• CMS Integrity Monitoring: Website operators should conduct integrity scans on web application root directories, review third-party JavaScript dependencies for unauthorized alterations, and enforce strict Content Security Policies (CSP) to block inline script injection and unauthorized external connections.