In a stark reminder of the evolving landscape of cyber warfare, security researchers at Ukraine’s Computer Emergency Response Team (CERT-UA) have uncovered a sophisticated, multi-stage malware campaign targeting unsuspecting web users. By compromising over 100 legitimate websites, threat actors have deployed a highly evasive attack vector that leverages blockchain technology to maintain persistence and control. The campaign, which utilizes a deceptive technique known as "ClickFix," culminates in the installation of "LunexStealer," a powerful information-stealing Trojan capable of total browser compromise and remote system manipulation.
Main Facts: The Anatomy of the ClickFix Deception
The attack begins with a familiar but deadly social engineering tactic. Visitors to the compromised websites—which appear benign and legitimate—are suddenly confronted with a fraudulent verification page designed to mimic the ubiquitous Cloudflare bot-detection interface.
The prompt informs the user that they must verify their identity to continue browsing. To do this, the site provides instructions to open the Windows "Run" dialog, paste a specific command, and execute it. This is the crux of the "ClickFix" technique: the command is not a bot check, but a malicious script. Once executed, the command silently reaches out to an attacker-controlled server to download and install a malicious MSI (Microsoft Installer) package.
This campaign is distinguished by its use of blockchain-based Command and Control (C2). Attackers are storing their configuration data and malicious domain information within smart contracts on the Polygon and Ethereum blockchains. Because the malicious JavaScript injected into the compromised sites references these smart contracts to determine its behavior, the attackers can pivot their infrastructure, toggle the attack on or off, or update their delivery mechanisms without ever needing to touch the compromised web servers again. This creates a "decentralized" C2 layer that is notoriously difficult for law enforcement to disrupt.
Chronology of the Discovery
The discovery of this campaign, which came to light in September 2026, highlights the rapid escalation of automated, high-scale cyberattacks.
- Early September 2026: CERT-UA specialists detect an anomaly in traffic patterns across a cluster of websites. Initial investigations reveal the presence of obfuscated JavaScript code injected into the headers of these pages.
- Mid-September 2026: Analysis of the injected script confirms the use of blockchain-based instructions. The researchers identify that the script’s behavior is gated by smart contract calls on the Polygon and Ethereum networks.
- Late September 2026: The investigation reveals three distinct variants of the malicious MSI payload, each demonstrating increasing levels of sophistication in bypassing security controls.
- October 2026: CERT-UA releases a comprehensive technical advisory, detailing the indicators of compromise (IoCs) and the full functionality of the LunexStealer malware, effectively alerting the international cybersecurity community to the threat.
Supporting Data: A Three-Pronged Approach to Infection
CERT-UA’s forensic breakdown of the three MSI variants reveals a deliberate effort by the threat actors to ensure the successful delivery of LunexStealer across various security environments.
Variant 1: The Direct Deployment
The simplest iteration of the attack, this variant focuses on the immediate download and execution of the stealer payload. It relies on the user’s gullibility to bypass initial security warnings and gain a foothold on the system.
Variant 2: The BYOVD (Bring Your Own Vulnerable Driver) Method
This is the most dangerous variant. Before deploying the stealer, the MSI package executes a series of "anti-security" routines. It attempts to carve out exceptions in Microsoft Defender and uses a Bring Your Own Vulnerable Driver (BYOVD) attack. By deploying a known vulnerable AMD driver (targeting CVE-2023-20598), the attackers can gain kernel-level privileges, effectively blinding security software and disabling Endpoint Detection and Response (EDR) agents before the payload is even triggered.
Variant 3: DLL Side-Loading
The third path avoids the use of vulnerable drivers entirely, opting for a more stealthy approach. The installer uses DLL side-loading, wherein a legitimate, signed executable is tricked into loading a malicious library. This library then decrypts and launches the primary LunexStealer payload, allowing the malware to execute under the guise of a trusted Windows process.
The LunexStealer Ecosystem: More Than Just a Credential Grabber
Once the payload is successfully executed, the victim’s machine is fully compromised. LunexStealer is not a passive credential harvester; it is a full-featured Remote Access Trojan (RAT). It possesses the capability to download additional files, execute PowerShell scripts, run raw commands, and deploy secondary malware at the attacker’s whim.
The LUNARAXE Extension and Browser Hijacking
Perhaps the most invasive feature of the campaign is the installation of the "LUNARAXE" browser extension. Disguised under the innocuous name "Microsoft Office Word Editor," this extension grants the attacker deep visibility into the user’s digital life.
- Data Exfiltration: It captures browser cookies, session tokens, full browsing history, and any data entered into web forms (including passwords and credit card numbers).
- Live Control: Attackers can remotely manage browser tabs, take snapshots of active windows, execute arbitrary JavaScript on pages the user is viewing, and modify browser proxy settings to intercept further traffic.
The NAIVEMESS Component
To bridge the gap between the browser and the underlying operating system, the attackers deploy the "NAIVEMESS" component. This is a PowerShell-based utility that registers itself as a browser-to-system messaging host. By acting as this legitimate interface, it grants the malicious browser extension the ability to manipulate the computer’s file system directly—reading, writing, or launching files without the user’s explicit authorization.
Official Responses and Strategic Implications
The CERT-UA advisory emphasizes that the campaign is designed to be "quiet." The malware is configured to target only Windows users arriving via search engines, and it limits the frequency of the fake verification pop-ups to twice per 12-hour period per user. This deliberate throttling is a calculated effort to minimize the "noise" that would otherwise alert system administrators or automated threat-hunting platforms to the malicious activity.
Recommendations for Mitigation
CERT-UA has provided a clear roadmap for organizations to protect themselves against these blockchain-enabled threats:
- User Education: The most critical defense is user awareness. A legitimate security check will never ask a user to open the Windows "Run" dialog, Command Prompt, or PowerShell to paste a command. Any request to do so is a clear indicator of malicious intent.
- Administrative Restrictions: Organizations should proactively restrict the use of the
Win+Rdialog via Group Policy (GPO) for non-technical users. - Application Control: Implementing strict application whitelisting and limiting the ability to execute MSI files from unauthorized locations can prevent the initial deployment of the installer.
- Vulnerability Management: Organizations must actively block known vulnerable drivers (using tools like the Microsoft Vulnerable Driver Blocklist) to mitigate the risk of BYOVD attacks.
The Broader Implications for Cybersecurity
The "LunexStealer" campaign represents a concerning shift in the professionalization of cybercrime. By utilizing the blockchain as a persistent, decentralized control layer, attackers have moved beyond the traditional "C2 server" model, which was vulnerable to takedowns by ISPs and hosting providers.
This campaign also highlights the continuing effectiveness of "living-off-the-land" techniques. By abusing legitimate Windows functionality—such as the "Run" dialog, MSI installers, and signed binaries—attackers are effectively turning the operating system’s own design against the user.
As we look toward the future of digital defense, the integration of blockchain in attack infrastructure suggests that we are entering an era where decentralized, immutable command structures will become more common. Security teams must move beyond static blacklisting and focus on behavioral analysis, behavioral heuristics, and the hardening of endpoints against the very tools that define the modern Windows environment.
The compromise of over 100 websites serves as a sobering reminder that the "trust" model of the internet is increasingly fragile. Whether a site is reputable or obscure, the presence of injected JavaScript can transform a routine visit into a security catastrophe. In this environment, the only reliable defense is a combination of technical rigor—such as restricting administrative tools—and a healthy dose of skepticism when the browser asks for anything more than a simple click.
