Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
Hacked Ukrainian sites serve fake Cloudflare pages to lure victims into downloading Psychedelic Stealer.
A ClickFix campaign is compromising Ukrainian websites, presenting fake Cloudflare verification pages to trick visitors into downloading a new information stealer called Psychedelic. The malware harvests browser credentials, account tokens, and cryptocurrency wallet data, and establishes persistence by contacting a C2 server. The attack chain involves injecting iframes with malicious JavaScript and using MSI installers to deliver the final payload.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonAttackers compromised legitimate Ukrainian websites by injecting malicious iframes and JavaScript to display convincing fake Cloudflare CAPTCHA verification pages — a ClickFix social engineering technique designed to trick users into voluntarily executing malware. Visitors who followed the prompts inadvertently installed the Psychedelic stealer, which harvests browser credentials, session tokens, and cryptocurrency wallet data. This attack succeeds because users inherently trust recognizable brand interfaces like Cloudflare, lowering their guard against unusual installation requests. The incident highlights the dual risk of website owners failing to secure their CMS platforms and end users lacking awareness of browser-based social engineering tactics. Malware achieving C2 persistence means compromised systems can be leveraged for extended campaigns well beyond the initial infection.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — fsputnik[.]com
- domain — uasputnik[.]com
- ip — 107.175.82[.]242
- malware — Psychedelic Stealer