CERT-UA: 100+ Hacked Sites Spread LunexStealer via Fake Cloudflare Checks

CERT-UA identified more than 100 compromised websites injected with malicious JavaScript to deliver an infostealer called LunexStealer (aka Psychedelic Stealer). The September 2026 activity has been attributed to a threat cluster tracked as UAC-0277.

• CERT-UA found over 100 compromised sites with malicious JavaScript
• The infostealer LunexStealer is also known as Psychedelic Stealer
• Activity was observed in September 2026
• The campaign is attributed to threat cluster UAC-0277