UAC-0277 (LunexStealer): fake-Cloudflare ClickFix injection on compromised sites

One hunt for the whole campaign. YARA anchor: the current loader, <script data-contract="0x..."> with its obfuscated string table (/tds/tds.php, /banner.html, the fullscreen iframe id, the getConfig selector); contract seen 0x8e02b8245a416f7ea713f559c674d99fa2f979f9 (Polygon). Search anchor: pages matching the first-generation stub rule (UAC0277_Tracker_Stub), or that contacted a host which served the stub, the fake check or the MSI, or one of the last TDS domains before the operator switched the loader off on 2026-10-05: fsputnik[.]com, flareua[.]live, flareru[.]live, uasputnik[.]com, partaonline[.]click, vibestglobal[.]com, plerdgate[.]com, vatra[.]pp[.]ua, fainomedia[.]pp[.]ua, trembita[.]pp[.]ua, lunelle[.]click, violea[.]click, lumelle[.]click, solivellse[.]online, velamira[.]online, amavelle[.]online, auriselle[.]online, elavelle[.]online, olivelle[.]online. The older TDS domains rotated every few hours to days and are not listed. An infected site keeps the loader while the TDS is switched off, so a sighting can show a normal-looking page.