CERT-UA Tracks 100+ Sites Deploying LunexStealer via EtherHiding and ClickFix MSI Variants

The campaign attributed to UAC-0277 employed three operating modes stored on-chain, activating only for Windows users arriving from search engines and limited to two exposures per twelve hours. Mode 2 triggered the ClickFix lure that executed MSI packages. Variant 2 abused the vulnerable AMD PDFWKRNL.sys driver to disable security tooling and add Defender exclusions while Variant 3 used DLL sideloading through FnHotkeyUtility.exe.

LunexStealer installs the LUNARAXE browser extension for credential theft and remote browser control alongside the NAIVEMESS PowerShell component that grants file-system access via native messaging. Commands flow through the extension, which strips CSP headers and exfiltrates data in Base64 chunks. This architecture combines on-chain domain resolution with living-off-the-land execution to evade both network and endpoint detection.

Independent reporting from Arctic Wolf Labs and Ontinue previously documented LUNARAXE deployment in other ClickFix operations, indicating UAC-0277 is iterating on a shared technique set rather than operating in isolation. The absence of victim telemetry or confirmed infections in the CERT-UA advisory leaves open the question of whether the campaign achieved scale or remained in testing.

Defenders should monitor Polygon and Ethereum contracts for new mode-2 activations and flag MSI packages that reference AMD drivers or perform immediate Defender exclusion commands. Continued use of blockchain C2 hiding suggests the tactic will migrate to additional commodity stealers within months.