100+ Compromised Sites Use Fake Cloudflare Checks to Drop LunexStealer

Thu, 08 Oct 2026 17:51:36 +0000

Engineer — Learn: The fake Cloudflare verification lure (ClickFix-style JS injection) is an evolving delivery pattern worth factoring into web security design, but no specific software patch or configuration action is indicated today.
SOC/IR — Plan: The fake CAPTCHA/Cloudflare check TTP is gaining traction as a malware delivery vector; build or tune detections for unexpected script execution following browser verification prompts, and monitor for CERT-UA’s LunexStealer IOC release to enable retrospective hunting.
Leader — Skip

Fake-Captcha on CuraSec