The Attack: Fake Cloudflare Verification Pages Delivering Stealer Malware
CERT-UA identified over 100 compromised websites injected with malicious JavaScript that displays fake Cloudflare verification pages to Windows users arriving from search engines. The page prompts visitors to “verify they’re human” by copying and executing a PowerShell command. That command downloads a malicious MSI package from a remote server and installs LunexStealer — an information stealer that exfiltrates browser data, credentials, cookies, and files from the victim’s system.
The attack uses the ClickFix social engineering technique and EtherHiding to retrieve configuration from Ethereum or Polygon smart contracts. Three MSI variants were observed: one that installs LunexStealer directly, one that bypasses UAC and disables Microsoft Defender before retrieving the stealer, and one that uses DLL sideloading with a legitimate Fujitsu binary to execute the payload.
Once installed, LunexStealer deploys a malicious browser extension called LUNARAXE that masquerades as “Microsoft Office Word Editor.” The extension steals cookies, browsing history, and credentials entered into web forms. It also installs NAIVEMESS — a PowerShell-based Native Messaging Host that provides the browser extension with direct access to the Windows file system. NAIVEMESS can list drives, browse directories, read files, create files, overwrite files, execute files, and archive directories into ZIP files for exfiltration.
Why Traditional Defenses Struggle
This attack chain exploits the fact that most security tools operate after the malicious payload has already been written to disk. Signature-based antivirus might catch known variants of LunexStealer, but a new variant released this morning won’t be recognized until researchers analyze it, create a signature, and push an update. That window — hours or days — is exactly when these attacks succeed.
The social engineering component bypasses user awareness training. The fake Cloudflare page looks legitimate. The PowerShell command appears technical but harmless to most users. By the time the MSI package is executing, the user has already made the decision to trust it.
CERT-UA recommends blocking the Windows Run dialog via group policy, restricting MSI installation to administrators, monitoring msiexec.exe execution, and enabling Microsoft’s vulnerable driver blocklist. These are all valid mitigations, but they require administrative overhead, user education, and consistent enforcement across every endpoint.
How FileSure Blocks This Attack at the File System Layer
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts file system operations before they complete. It doesn’t try to recognize LunexStealer or any other specific malware. It simply enforces a policy: unauthorized programs cannot write executable files to this system.
When the PowerShell command attempts to download and write the MSI package to disk, FileSure intercepts that write operation. PowerShell is not on the authorized list of programs permitted to write MSI files. The operation is blocked. The file never lands. The stealer never installs. The browser extension never deploys. NAIVEMESS never gets file system access.
The attack stops at the earliest possible point — before the payload touches the disk.
Here’s a specific FileSure rule configuration that would have prevented this attack:
File name filter: *.msi;*.exe;*.dll;*.ps1;*.bat;*.cmd;*.vbs
Program name filter: powershell.exe;cmd.exe;wscript.exe;cscript.exe
Operations: Write, Create
Drive type: Hard drives, Removable drives
Result: Block
This rule prevents command-line interpreters and scripting engines from writing executable files to disk. Normal users never need PowerShell to write an MSI package or an EXE file. If PowerShell tries to do that, it’s either malware delivery or an administrative task that should be performed by an authorized deployment tool.
Even if the MSI package somehow bypassed this rule, FileSure has a second layer of defense. When the stealer attempts to write its executable payload, DLL files, or the NAIVEMESS PowerShell script to disk during installation, those are additional write operations that FileSure intercepts. Each one is blocked individually.
And if the browser extension somehow gets installed and NAIVEMESS attempts to read sensitive files, create ZIP archives, or write exfiltrated data to disk, those operations are also intercepted. FileSure controls read, write, create, delete, and rename operations. The NAIVEMESS component’s entire function — “retrieving the list of drives, browsing directories, reading, creating and overwriting files” — is a list of file system operations that FileSure enforces policies on.
The malware can’t steal files it can’t read. It can’t exfiltrate data it can’t write to disk for staging. It can’t persist if it can’t write executables during installation.
This works on LunexStealer variants that don’t exist yet. It works on the next stealer malware that uses a different name and different obfuscation. It works because the attack fundamentally requires writing files to a Windows system, and FileSure controls that operation at the kernel level.
Try FileSure free for 21 days at bystorm.com — see it block a simulated attack in under three minutes.
Source: 100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
Category: Ransomware
Tags: lunexstealer, clickfix, etherhiding, msi malware, browser extension malware, naivemess, kernel filter driver, file system security
