Attackers compromised legitimate Ukrainian websites and showed visitors a fake CAPTCHA/Cloudflare-style “verification” prompt to trick them into installing malware. The infection chain drops Lunex (aka Psychedelic Stealer), which disables security monitoring using a vulnerable AMD driver and then steals browser passwords, session cookies, and crypto wallet data.
This attack chain begins on legitimate Ukrainian websites that have been compromised. Attackers inject an iframe element designed to serve a ClickFix-style lure, a fake Cloudflare verification page that asks visitors to complete a CAPTCHA or security check. Instead of a normal verification, the page instructs users to download and run a bogus MSI installer. Once executed, the chain deploys Lunex Stealer, also known as Psychedelic Stealer, which uses a bring your own vulnerable driver technique with an AMD Radeon driver to blind security monitoring tools while keeping them appearing to run normally.
The lure works because it appears on websites users already trust, removing the usual suspicion attached to unfamiliar domains. A CAPTCHA or security verification prompt feels routine and expected, so the request to run an installer or follow verification steps does not immediately register as unusual. The technical evasion compounds this: disabling security tools without stopping them from running means monitoring systems may not flag the compromise in real time, giving the stealer time to harvest browser passwords, session cookies, and cryptocurrency wallet data across seven Chromium-based browsers.
Organizations across retail, healthcare, manufacturing, and professional services should train all employees, IT helpdesk staff, and security operations teams to treat CAPTCHA-style verification prompts with caution, especially when they request an installer or command execution. Finance teams with cryptocurrency exposure face added risk given the stealer's wallet-targeting capability. Encourage staff to report suspicious verification pages rather than complete them, and reinforce that even familiar, trusted websites can be compromised and used to deliver malware through injected content.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a lure where attackers inject a fake Cloudflare-style verification page onto compromised legitimate websites, prompting visitors to run an installer or commands to prove they are human, which instead installs malware.
Lunex, also known as Psychedelic Stealer, uses a vulnerable AMD driver to blind security tools while leaving them appearing to run, then steals browser passwords, session cookies, and cryptocurrency wallet data from seven Chromium-based browsers.
Yes. The attackers compromised legitimate Ukrainian websites and injected an iframe to serve the fake CAPTCHA lure, showing that a familiar site does not guarantee safety.
Red flags include an unexpected verification or CAPTCHA prompt asking you to download or run an installer, a security check appearing on a normally trusted site, and any instructions to run an MSI file or commands to fix access.
You land on a trusted site and a Cloudflare-style page pops up: “Please verify you are human to continue.” Looks normal, right? Here’s the trick: that “ClickFix-style Cloudflare verification” is fake. The compromised site pushes a bogus MSI installer that drops Lunex Stealer, which quietly blinds your security tools and raids your browser passwords, session cookies, and crypto wallets. The aha: real CAPTCHAs never make you download an MSI. If a “security check” suddenly tells you to run an installer to fix access, even on a site you trust, that’s a Lunex-style trap. If any CAPTCHA or Cloudflare-style page asks you to download or run anything, stop, close the tab, and report it to security with a screenshot and the site address.
Attackers compromised over 100 legitimate websites and showed visitors in Ukraine a fake Cloudflare verification page. The page instructed users to copy and run a PowerShell command, which instead installed Lunex Stealer to steal passwords, tokens, and crypto wallet data and enable remote access.…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
Researchers report a new PamStealer variant that lures macOS users to a fake cryptocurrency wallet website and tricks them into running a script-based installer. The malware downloads a decryption tool and relies on a live server key exchange, making the real payload harder to analyze and helping…
A commonly used documentation placeholder domain, third-party.com, was registered by an unknown party and is now serving a ClickFix social-engineering lure to Windows users. The page pretends to run a Cloudflare security check, silently poisons the clipboard, and tells victims to paste and run a…
Researchers uncovered a long-running “SEO poisoning” operation that manipulates Bing search results to push people onto fake support and activation pages. Victims are steered through a chain of redirects to either download a malware-laced ZIP (MayaBot) or be pressured into calling a fake…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
