Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
UAC-0277 Hackers Compromise 100+ Websites to Spread LUNEXSTEALER via ClickFix Attacks
Malware Families
Excerpt
Ukraine’s Computer Emergency Response Team, discovered more than 100 compromised websites in September 2026 distributing LUNEXSTEALER through fake Cloudflare verification pages. The agency tracks the activity as UAC-0277. Attackers injected malicious JavaScript into legitimate websites, turning ordinary visits into opportunities to infect Windows computers. The fraudulent pages asked visitors to run a command to prove they were human. Instead of completing a security check,…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2023-20598 | Medium | Score 54/100 | First seen |
| IP | 107.175.82.242 | High | Score 81/100 | First seen |
| IP | 193.178.158.61 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…