[lunex-stealer]

October 7, 2026

• ClickFix is hiding its payloads better. Microsoft Threat Intelligence describes compromised sites pre-fetching a script into the browser cache disguised as a PNG, so the pasted command loads locally instead of pulling a remote payload — sidestepping Windows Run dialog length limits and the usual network-stage detections; DNS TXT records are also being used as payload storage (The Hacker News, Dark Reading). Separately, CERT-UA found over 100 compromised Ukrainian websites serving fake Cloudflare checks that drop Lunex Stealer, including a Chromium extension posing as "Microsoft Office Word Editor" and a component reaching the filesystem; tracked as UAC-0277 (The Record). · Threat Activity

in Pre-Auth File Read Hits Eight Atlassian Data Center Products

September 27, 2026

• Lunex Stealer abuses an AMD driver to disable security monitoring in a four-stage chain targeting Ukrainian-speaking users, starting from fake Cloudflare CAPTCHA pages on compromised Ukrainian sites. Ontinue ties the previously reported Psychedelic Stealer to the wider Lunex MaaS platform (The Hacker News). · Threat Activity

in Citrix NetScaler Zero-Days Land Mid-Weekend, No Patch Until Next Week