CERT-UA warns about a harmful campaign disguised as a "Bot Detection" check
CERT-UA has detected a widespread distribution of malicious software: in September 2026, more than 100 compromised websites with a fake Cloudflare "I am not a robot" check were found. Windows users are being offered to copy and run a command, after which the LUNEXSTEALER program is downloaded. The legitimate check never requires Win+R or the command prompt – such a page should be immediately closed.
CERT-UA, the national cybersecurity incident response team of the Ministry of Digital Affairs, has detected a widespread distribution of malicious software. In September 2026 year, experts identified over 100 compromised websites that had been injected with malicious JavaScript code by attackers.
Visitors to such resources may be shown a fake Cloudflare verification page, which looks like a normal confirmation that the user is not a robot. Subsequently, the person is offered to copy and execute a specific command; if they agree, a malicious program is downloaded and installed on their computer. The page is not shown to everyone: the attack is targeted at Windows users who have visited the website through search engines, such as Google, DuckDuckGo, meta.ua, and bigmir.net, and it appears no more than twice within 12 hours.
CERT-UA emphasizes: A legitimate CAPTCHA or Cloudflare verification will never ask you to press Win+R, open the command prompt or PowerShell, or paste and run commands. If you are asked to do any of these things, you should immediately close the page, even if the website appears familiar or trustworthy.
This campaign utilizes the malicious program LUNEXSTEALER, which is disguised as ordinary files and exploits vulnerabilities in Windows system drivers. After infection, a malicious browser extension called "Microsoft Office Word Editor" may appear on the computer without the user's knowledge. This extension steals login credentials, passwords, and browsing history, allowing attackers to remotely control the infected computer. The Polygon and Ethereum blockchain networks are used to manage the infrastructure of the attack, enabling rapid changes to its settings.
CERT-UA advises system administrators to restrict access for regular users to the "Run" window (accessed via Win+R) and to install MSI packages without administrator privileges, to implement the Microsoft Vulnerable Driver Blocklist, and to allow only verified extensions in web browsers.