Compromised Ukrainian Websites Deliver Psychedelic Stealer Through Fake Cloudflare Verification

Severity

High

An active ClickFix campaign has compromised legitimate Ukrainian business websites and injected fake Cloudflare verification pages to trick visitors into executing a malicious Windows Installer command. The attack delivers a previously undocumented information stealer known as Psychedelic, which targets browser credentials, account tokens, and cryptocurrency wallet data.

The compromised websites belonged to businesses across different sectors, including a hair-treatment clinic, scale-model manufacturer, specialist bookseller and publisher, psychological facility, tool retailer, and automotive retailer. The sites were modified with an injected iframe that loaded attacker-controlled JavaScript.

How?

When a visitor accesses a compromised website, the injected content displays a fake Cloudflare verification page with Ukrainian-language instructions. Instead of performing a legitimate CAPTCHA check, interacting with the page copies an msiexec.exe command to the Windows clipboard.

The victim is then instructed to open the Windows Run dialog and paste the command. The command downloads an MSI installer from attacker-controlled infrastructure, which subsequently retrieves and executes the Psychedelic Stealer payload.

The campaign uses several MSI payloads, including elita.msi, miks.msi, astra.msi, harbor.msi, neon.msi, sova.msi, and vyse.msi. The MSI installer retrieves the next-stage executable, psychedeliclove.exe, which is the Psychedelic Stealer payload.

Psychedelic Stealer is capable of collecting credentials from Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex. It also targets browser account tokens and cryptocurrency wallets, including MetaMask, Trust Wallet, OKX Wallet, SafePal, Exodus, Atomic Wallet, Electrum, Bitcoin Core, and Litecoin Core.

The malware establishes persistence through a scheduled task and can modify browser profiles by deploying an extension and native-messaging component. It also collects information about the compromised host and communicates with its C2 infrastructure to receive additional commands.

The C2 functionality allows the malware to retrieve and execute additional EXE, COM, BAT, CMD, MSI, and PowerShell payloads, giving the attackers the ability to expand the compromise beyond information theft.

Arctic Wolf identified a traffic distribution system associated with the campaign that recorded 557 views, 426 clicks, and 79 completed interactions across 32 countries. Ukraine accounted for the majority of recorded activity, with 446 views, 351 clicks, and 71 completed interactions.

The campaign demonstrates how ClickFix can turn a compromised legitimate website into a malware delivery platform by abusing familiar verification prompts and trusted Windows utilities. The use of msiexec.exe also avoids relying on more commonly detected PowerShell-based execution methods.

Recommendation

Avoid executing commands copied from website verification pages or pop-up instructions.
Treat unexpected msiexec.exe executions initiated from browsers as suspicious.
Monitor for unusual scheduled tasks created by user-level applications.
Monitor browser profile changes and unexpected browser extensions or native-messaging components.
Investigate suspicious downloads of MSI files from unfamiliar domains.
Monitor for unexpected access to cryptocurrency wallet files and browser credential stores.

Source

https://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.html