Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
Computer Emergency Response Team of Ukraine issued a threat advisory detailing an active cyber campaign tracked as UAC 0277. The operation compromised more than 100 legitimate web portals, injecting malicious JavaScript to transform normal visitor traffic into malware distribution points. The primary goal of the threat actor is the deployment of LunexStealer, an information stealing Trojan designed to harvest sensitive user data and establish persistent browser control.
EtherHiding Resolution and ClickFix Delivery Dynamics
The injected web code leverages the EtherHiding technique, retrieving configuration parameters and target operational domains directly from smart contracts hosted on the Polygon or Ethereum blockchain networks. These smart contracts govern the script operating modes, controlling whether the site remains dormant, passively logs visitor metrics, or actively presents malicious lures. When active, the script identifies incoming Windows users arriving via major search engine results and renders a forged Cloudflare human verification screen. Utilizing the ClickFix social engineering technique, the fake verification page prompts visitors to execute a command that triggers the download and installation of malicious Windows Installer packages.
Multi Variant MSI Installers and LUNARAXE Extension Integration
Operators deploy three distinct Windows Installer package variants to establish footholds and neutralize system defenses:
Direct Installation Variant: Installs LunexStealer directly onto the host operating system without secondary staging.
Defensive Evasion Variant: Bypasses User Account Control, configures Microsoft Defender exclusion lists, and leverages a vulnerable AMD system driver to blind active endpoint detection tools before fetching the main payload.
DLL Sideloading Variant: Weaponizes a legitimate hotkey application binary to sideload a rogue library, decrypting and running the main executable in system memory.
Following successful execution, the stealer registers a malicious browser extension called LUNARAXE, disguised as Microsoft Office Word Editor. The extension strips Content Security Policy headers, intercepts form login credentials, harvests session cookies, and executes remote JavaScript. To interact with local file storage, the extension deploys an auxiliary PowerShell component named NAIVEMESS, granting the attacker remote file creation, directory browsing, and data exfiltration capabilities across the underlying host file system.
Defensive Controls and Technical Mitigations
To contain exposure to this multi stage compromise chain, security operations teams must implement strict environment controls:
Disable User Script Execution: Enforce group policies to restrict non administrative users from opening the Windows Run dialog or executing arbitrary commands.
Restrict Package Installer Permissions: Limit Windows Installer execution rights and actively monitor for unauthorized command line calls to the installer process.
Driver Blocklisting and Surface Reduction: Enable Microsoft vulnerable driver blocklists and activate Attack Surface Reduction rules to prevent applications from writing signed vulnerable drivers to local storage.
Enforce Browser Extension Allowlisting: Implement browser management policies that strictly restrict browser extension installations to explicitly approved enterprise allowlists.
Comments