Fake Cloudflare Verification Pages Used to Spread LUNEXSTEALER Malware on Over 100 Websites

Cybercriminals have seized control of more than a hundred websites, turning ordinary page visits into a delivery vector for the Windows‑based trojan LUNEXSTEALER. The group accomplishes this by injecting counterfeit Cloudflare verification screens that mimic the familiar “checking your browser” notice, then redirecting visitors to the malicious payload. Security researchers first spotted the coordinated campaign earlier this month, highlighting its scale and the deceptive exploitation of a trusted security service’s branding.

LUNEXSTEALER is engineered to siphon a variety of personal and corporate information from infected machines. Once it lands, the malware can steal login credentials, browser cookies, and files stored locally. It also opens a remote‑control channel, allowing operators to issue commands such as downloading additional tools, exfiltrating data, or deploying ransomware. Its modular design lets it adapt to different victim environments.

The attack vector hinges on compromising the web server or its content‑management system and then serving a forged Cloudflare interstitial page. Visitors to the hijacked site see a page that replicates Cloudflare’s standard “Checking your browser before accessing” message, complete with the logo and timing animation. After a short pause, the page automatically forwards the user to a malicious executable on the attacker’s server, where the LUNEXSTEALER payload is fetched and executed.

Analysts have catalogued a varied set of compromised domains, ranging from small‑business storefronts to larger news portals. The common thread appears to be the presence of third‑party plugins or outdated software that offered an entry point for the attackers. By exploiting these weak spots, the criminals were able to inject the fake verification page without alerting site administrators, allowing the operation to run unnoticed for weeks.

The consequences for end users are serious. A successful infection grants threat actors access to sensitive personal data, financial information, and corporate secrets. Because the malware also accepts remote commands, compromised machines can be conscripted into broader botnets or serve as footholds for further intrusion into corporate networks. The use of a trusted brand like Cloudflare adds credibility that may lower users’ suspicion.

Security firms responding to the incident recommend that site owners perform immediate code audits, verify the integrity of all third‑party components, and enforce strict access controls on their servers. Implementing subresource integrity checks and monitoring for unauthorized HTML changes can help spot similar tampering. For users, keeping Windows systems patched, running reputable anti‑malware tools, and being wary of unexpected verification screens are essential defensive measures.

Investigations remain ongoing to map the full command‑and‑control infrastructure behind LUNEXSTEALER. Researchers suspect the attackers may reuse the same technique against additional sites, given the low cost of hijacking a Cloudflare‑style page. The episode underscores the importance of continuous security hygiene and the danger of assuming familiar security cues are always trustworthy.