ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware
2026-10-06T14:51:48Z•76fd99f57af56353272728b70bf17d46c5535dfc1a68238237867e425ff83cef
CERT-UAClickFixLunex infostealerUkrainecredential theftfake Cloudflare verificationinformation stealermalware distributionsocial engineeringwebsite compromise
What happened
CERT-UA identified a ClickFix social-engineering campaign that compromised more than 100 websites in Ukraine and used fake Cloudflare verification pages to trick visitors into executing malicious commands, resulting in Lunex infostealer infections. The activity primarily targets credential and information theft through browser-based user deception.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- therecord_media
- Record identifier
- 76fd99f57af56353272728b70bf17d46c5535dfc1a68238237867e425ff83cef
- Enrichment time
- 2026-10-06T14:51:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.