Ukraine’s Computer Emergency Response Team, CERT-UA, has reported that more than 100 compromised websites were altered to deliver an information-stealing malware known as LunexStealer, also referred to as Psychedelic Stealer. According to the agency, attackers injected malicious JavaScript into affected sites and used fake Cloudflare-style verification checks as part of the delivery chain.

While the full scope of victims and the identity of the operators were not disclosed in the source material, the incident is a useful reminder for European businesses: a hacked website is not only a risk to the site owner’s data and operations, but can also become a malware distribution point affecting customers, staff and partners.

What happened

CERT-UA said it identified more than 100 compromised websites that had been modified with malicious JavaScript. The activity was observed in September 2026 and attributed by the agency to a threat cluster it tracks as UAC-0277.

The injected code reportedly displayed fake Cloudflare checks to website visitors. Instead of providing a legitimate anti-bot or browser verification step, the pages were used to deliver LunexStealer, a type of malware designed to steal information from infected systems. Information stealers commonly target browser data, saved credentials, session cookies, cryptocurrency wallets or other locally accessible data, although the exact capabilities relevant to this campaign were not detailed in the source provided.

Why it matters for European businesses

This incident matters because many SMEs rely on their websites as a core business asset for lead generation, ecommerce, customer support and brand credibility. If a website is compromised and used to serve malware, the consequences can extend beyond normal website downtime.

• Customer trust risk: visitors who encounter fake verification checks or become infected may associate the incident with the brand that owns the website.
• Credential theft risk: information-stealing malware can enable follow-on attacks against email accounts, ecommerce back offices, cloud platforms and business software.
• Operational risk: a compromised site may require emergency remediation, forensic review, password resets and communication with hosting or security providers.
• Compliance and reporting implications: if a website compromise also affects personal data or internal systems, organisations may need to assess GDPR-related obligations or sector-specific incident processes.

The use of a fake Cloudflare-style prompt is also significant. Many users are now familiar with browser checks, CAPTCHA pages and anti-bot interstitials. Attackers are exploiting that familiarity to make malicious prompts appear routine. For businesses, this raises the importance of both technical controls and user awareness.

Who may be affected

• SMEs running CMS-based websites such as WordPress or other widely deployed platforms, especially where plugins, themes or admin accounts are not tightly managed.
• Ecommerce businesses whose websites handle customer logins, checkout journeys or account areas and therefore face higher reputational and fraud risks.
• Marketing teams and digital agencies managing multiple websites, landing pages or third-party scripts across client environments.
• IT and security teams responsible for web hosting, content delivery, browser security and endpoint protection.
• Businesses in regulated sectors where a website compromise could trigger wider incident assessment, supplier review or customer notification requirements.

What companies should consider

• Review website integrity: check for unexpected JavaScript, modified templates, unauthorised admin users and unexplained changes to third-party scripts or tags.
• Harden CMS and hosting environments: apply security updates, remove unused plugins and themes, restrict administrative access and enforce multi-factor authentication.
• Monitor for malicious changes: use file integrity monitoring, change alerts and external website scanning to detect injected code quickly.
• Audit third-party dependencies: review CDN, tag manager and script inclusions to ensure only necessary and trusted components are loaded.
• Prepare an incident response process: ensure teams know how to isolate the site, preserve evidence, restore clean versions and rotate credentials if compromise is detected.
• Strengthen endpoint protection: because website-based malware delivery targets visitors as well as administrators, businesses should ensure employee devices have current endpoint security and browser protections.
• Train staff to recognise suspicious verification prompts: fake anti-bot pages, unexpected download requests or unusual clipboard instructions should be treated as warning signs.

For European companies, the broader lesson is clear: website security is not only a hosting issue. It is part of cybersecurity, brand protection and business continuity. Organisations that depend on web traffic, online sales or customer portals should treat script injection and content tampering as a board-level digital risk, not just a technical nuisance.