UPDATE 7 Oct 2026: CERT-UA says a cluster it tracks as UAC-0277 injected malicious JavaScript into more than 100 compromised websites in September 2026 to push LunexStealer (Psychedelic Stealer). Visitors saw a fake Cloudflare verification page telling them to run a command (ClickFix), which downloaded and installed an MSI package; at least three MSI variants were found. The script pulls the lure's domain and its mode from a smart contract on Polygon or Ethereum (EtherHiding), with modes for off, passive visitor tracking and showing the lure, and it shows the lure only to Windows users arriving from search results, at most twice in 12 hours.

CERT-UA describes a malicious browser extension, LUNARAXE, posing as “Microsoft Office Word Editor” to steal cookies, history and form credentials and let the operator run JavaScript in pages, plus a PowerShell Native Messaging Host component, NAIVEMESS, that gives it file-system access. CERT-UA did not name victims.

UPDATE 26 Sep 2026: Ontinue CDC (published 24 September 2026; The Hacker News 26 Sep) reverse-engineers the four-stage chain behind the Ukrainian ClickFix campaign Arctic Wolf named Psychedelic Stealer. Ontinue identifies Lunex as the underlying malware-as-a-service platform (Russian-language panel UI; 28 panels across 13 countries vs six in June 2026 BlueTeamCoolTeam OSINT) and Psychedelic / LunexStealer as the same endpoint payload.

Delivery remains fake Cloudflare CAPTCHA → msiexec MSI (elita.msi / siblings from uasputnik[.]com) installing per-user “Vertification” by “Internal Software”. Loader (config.exe / psychedelic.exe) uses CMSTPLUA COM elevation (no UAC) then BYOVD: loads AMD Radeon / USB-C PD firmware driver PDFWKRNL.sys (Authenticode-signed; susceptible to CVE-2023-20598) and zeroes kernel callbacks (PDB-guided via Microsoft Symbol Server) so EDR stays running but blind — Ontinue notes neither HVCI nor the current Microsoft Vulnerable Driver Blocklist blocked the variant (hash in LOLDrivers since March 2026).

Final stage steals seven Chromium browsers + wallets, injects a Chrome extension via Secure Preferences, and persists a PowerShell Native Messaging Host (panel C2 incl. 193.178.159[.]128). Arctic Wolf first documented the Ukrainian-site ClickFix lure 24 Sep (desk primary); Ontinue supplies the Lunex platform / BYOVD depth. No new CVE beyond CVE-2023-20598 on the abused AMD driver.

Primary update: Ontinue; wire: THN 26 Sep; original lure: Arctic Wolf.