Ukraine has spent four and a half years hardening the physical layer of its internet: satellite terminals, whitelists, and plans for a domestically controlled constellation. On October 6, 2026, The Record reported that CERT-UA, the national computer emergency response team, had found a campaign that went around all of it. Attackers compromised more than 100 legitimate websites, including an online store and a children's coloring-page site. Visitors saw a fake Cloudflare verification page telling them to paste a PowerShell command to prove they were human.
What the campaign did
The technique is called ClickFix. The victim runs the attacker's command, so no exploit is needed. According to The Record, following the instructions installed Lunex Stealer, which steals passwords, authentication tokens and cryptocurrency wallet data and gives attackers remote access. In some cases it also installed LunarAxe, a Chromium extension disguised as "Microsoft Office Word Editor." LunarAxe can steal cookies, browsing history and credentials, and it can manipulate tabs, run JavaScript on pages, take screenshots and change proxy settings. A companion component, NaiveMess, adds file-system access.
CERT-UA, which published its report on the activity, has not attributed the operation to a known group and tracks it as UAC-0277. It did not say how many machines were infected. Lunex is not a bespoke state tool. The Hacker News, summarizing Ontinue's research, reports that Lunex is a malware-as-a-service platform with 28 command-and-control panels identified across 13 countries, up from six documented in June 2026. Ukrainian-speaking users were the primary targets in the campaign Ontinue documented. That matters: the tooling is commercially available, so the barrier to entry for the next campaign is low.
The infrastructure story and the endpoint story
The connection to satellite dependency is analytical, not causal. Nothing in the reporting says Starlink was involved. But the two stories describe the same national problem from different layers.
At the network layer, Ukraine relies on one foreign operator. SkyCommons' country profile counts over 160,000 terminals, roughly 100,000 of them military, serving drones and command-and-control as well as schools, hospitals and households. Kyiv's response has been to tighten control. On February 1, 2026, the Cabinet of Ministers announced a system allowing only authorized terminals to operate, with unverified ones disconnected. Defence Minister Mykhailo Fedorov described this as the answer to Russian use of the technology on drones. The Kyiv Independent reported that civilians verify through administrative service centers, businesses through Diia, and the military through the DELTA platform. Beyond that, the state is backing UASAT LEO and a Stetman-led constellation to reduce reliance on SpaceX, according to SkyCommons.
The strongest case for the whitelist
The case for tight control is strong. Russia was using commercial terminals on low-flying drones that are hard to jam or intercept. Fedorov called a whitelist "currently the only technical solution." A wartime state cannot let an adversary ride on infrastructure that also carries its own command traffic. Registration also gives defenders an inventory they never had, and an inventory is a prerequisite for security.
The cost is that registration concentrates sensitive data, and a connectivity regime built on identity can be abused or fail at scale. That is a legitimate concern, but it is a manageable one. The harder lesson comes from the ClickFix campaign.
Resilient pipes do not protect the person at the keyboard
A satellite constellation, however sovereign, delivers packets to a browser. If the browser is running an extension that proxies traffic, steals session tokens and executes JavaScript, the network's resilience is irrelevant to that user. Infostealers also target exactly the assets that matter in wartime: authentication tokens that bypass multi-factor login, and credentials for the accounts of officials, volunteers and small businesses. The compromised sites in this campaign were ordinary ones, a shop and a children's site, which shows that attackers do not need to breach a ministry to reach a ministry employee's home computer.
This points to three pro-innovation, proportionate priorities.
- Fund endpoint defence where the money is already going. Satellite sovereignty is a multi-year, multi-hundred-million-dollar commitment. Endpoint measures cost a small fraction: managed browser policies that block unapproved extensions, and PowerShell restrictions on non-administrator accounts. These measures directly blunt a ClickFix chain.
- Teach one rule, loudly. No legitimate verification page asks a visitor to paste a command into a terminal. CERT-UA and platform providers can push that single message far more cheaply than they can patch millions of machines.
- Resist the temptation to regulate the web. The answer to compromised small sites is not mandatory licensing of site operators or content-scanning mandates, which would burden exactly the small publishers who were victims here. Faster abuse reporting, hosting-side malware scanning that providers adopt voluntarily, and CERT-UA's practice of publishing indicators are proportionate and protect an open web.
What to watch
Two things will show whether Ukraine is balancing its layers. First, whether CERT-UA's UAC-0277 reporting is followed by public guidance aimed at ordinary users rather than only technical indicators. Second, whether the sovereign-connectivity plans are paired with a stated security baseline for endpoints that connect through them. A nation can own its satellites and still lose its users' sessions to a fake CAPTCHA.
The open questions are real. CERT-UA did not say how many computers were infected, and attribution is unresolved. But the structural point stands without them: connectivity policy and cyber-hygiene policy have to be built together, and the second is the cheaper one to get right.