Psychedelic Stealer / LunexStealer MaaS infostealer deployment
Malware Activity
Summary
Hide ▲
Show ▼
CERT-UA reported more than 100 compromised websites injected with malicious JavaScript to deliver LunexStealer (aka Psychedelic Stealer) through fake Cloudflare verification pages and the ClickFix technique. The activity was attributed to UAC-0277 and observed in September 2026, with EtherHiding used to load the lure and MSI packages used to install the stealer. The campaign also used multiple MSI variants, including one that installs the stealer directly, one that abuses UAC and PDFWKRNL.sys, and one that uses FnHotkeyUtility.exe and spkvol.dll for DLL sideloading. CERT-UA said the infrastructure and lure logic were also used to gate delivery by browser, time window, and visit source.
Related Happenings
ClickFix compromised-website browser-cache campaign
Campaign
H score35
First: 06.10.2026 18:00
Last: 06.10.2026 18:00
Sources 1
About this happening:
The ClickFix campaign is using compromised websites to pre-stage a VBScript payload in the browser cache, pushing visitors into running attacker code through Windows...
ClickFix compromised-website browser-cache campaign
CampaignAbout this happening: The ClickFix campaign is using compromised websites to pre-stage a VBScript payload in the browser cache, pushing visitors into running attacker code through Windows...
PowerShell-triggered RAT payload on Windows
Malware Activity
H score22
First: 29.09.2026 23:59
Last: 29.09.2026 23:59
Sources 1
About this happening:
The PowerShell-triggered ClickFix chain deployed a remote access trojan (RAT) that gave operators remote desktop access, camera/audio capture, reconnaissance,...
PowerShell-triggered RAT payload on Windows
Malware ActivityAbout this happening: The PowerShell-triggered ClickFix chain deployed a remote access trojan (RAT) that gave operators remote desktop access, camera/audio capture, reconnaissance,...
NeedyMantis persistent-access malware framework
Malware Activity
H score23
First: 29.09.2026 16:30
Last: 29.09.2026 16:30
Sources 1
About this happening:
The NeedyMantis malware framework is enabling persistent access inside compromised networks, giving attackers a hidden foothold for follow-on operations and data theft. It...
NeedyMantis persistent-access malware framework
Malware ActivityAbout this happening: The NeedyMantis malware framework is enabling persistent access inside compromised networks, giving attackers a hidden foothold for follow-on operations and data theft. It...
ChainScript RAT delivered via ClickFix-like lures
Malware Activity
H score23
First: 21.09.2026 11:39
Last: 21.09.2026 11:39
Sources 1
About this happening:
The ChainScript RAT is being delivered through ClickFix-like lures, giving operators remote access and payload deployment control on compromised Windows system...
ChainScript RAT delivered via ClickFix-like lures
Malware ActivityAbout this happening: The ChainScript RAT is being delivered through ClickFix-like lures, giving operators remote access and payload deployment control on compromised Windows system...
PasteSwitch malicious ClickFix ads campaign via HBO Max Reddit account
Campaign
H score32
First: 21.09.2026 11:39
Last: 21.09.2026 11:39
Sources 1
About this happening:
The PasteSwitch campaign abused HBO Max's official Reddit account (u/hbomax) to push 108 malicious ads over 48 hours, turning a trusted brand channel into a delive...
PasteSwitch malicious ClickFix ads campaign via HBO Max Reddit account
CampaignAbout this happening: The PasteSwitch campaign abused HBO Max's official Reddit account (u/hbomax) to push 108 malicious ads over 48 hours, turning a trusted brand channel into a delive...
Timeline
-
26.09.2026 21:22 3 articles · 13d ago
Psychedelic Stealer / LunexStealer MaaS infostealer deployment
Initial DisclosureThe opening stage uses compromised Ukrainian websites and ClickFix-style verification pages to lure Ukrainian-speaking users into running a bogus MSI installer. That installer delivers LunexLoader, which prepares the system for the final stealer payload.
Show sources
- Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials — thehackernews.com — 26.09.2026 21:22
- Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials — thehackernews.com — 26.09.2026 21:22
- 100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer — thehackernews.com — 07.10.2026 09:57