src_cfc4f5388458c6f7fc
- Source-provided label
- Not reported
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Oct 07, 2026 13:22 UTC
- Retrieved
- Oct 08, 2026 03:49 UTC
CERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware
Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through ClickFix commands. The lure is the now-familiar ClickFix technique, dressed up as Cloudflare’s standard bot check. The fake page asks you to run a command, supposedly to confirm you’re not a bot, and that command quietly downloads and installs an […]
Reference details
- Source category
- Research & news
- Report title
CERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware- First reported
- Oct 07, 2026 13:22 UTC
- Last reported
- Oct 07, 2026 13:22 UTC
- Catalog updated
- Oct 08, 2026 03:49 UTC
- Record ID
6114e59b62b1b9384653fa8517eecc67110df71df6f2a1318485a548e34be2b5
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Review source update dates and status
- src_cfc4f5388458c6f7fcCollection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.