CERT-UA: ClickFix lures deliver Lunex stealer aimed at wallets
06 Oct 2026: CERT-UA (via SOC Prime) described UAC-0277 campaigns where compromised websites show a fake Cloudflare check that talks users into running a command.
The Lunex stealer payload takes browser credentials, sessions, and wallet data (desktop wallets plus MetaMask, OKX, SafePal extensions) and can disable security tools with a vulnerable driver.
Command infrastructure is managed via Polygon and Ethereum. No published loss total. Research snapshot from SOC Prime / CERT-UA.
369 take
Fake Cloudflare checks that ask you to run a PowerShell or MSI command are drain paths. Close the tab. Update OS and wallet extensions from official stores only.
Seeds and session cookies on an infected PC are already lost.
Sources