100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

CERT-UA identified more than 100 compromised websites injected with malicious JavaScript to serve LunexStealer (aka Psychedelic Stealer), an information-stealing malware. The activity, observed in September 2026, was attributed to threat cluster UAC-0277. The agency did not disclose who the attackers targeted or the full scope of the campaign.