Fake Cloudflare Pages on Hacked Ukrainian Sites Spread Psychedelic Stealer
Attackers compromised legitimate Ukrainian websites by injecting malicious iframes and JavaScript to display convincing fake Cloudflare CAPTCHA verification pages — a ClickFix social engineering technique designed to trick users into voluntarily executing malware. Visitors who followed the prompts inadvertently installed the Psychedelic stealer, which harvests browser credentials, session tokens, and cryptocurrency wallet data. This attack succeeds because users inherently trust recognizable brand interfaces like Cloudflare, lowering their guard against unusual installation requests. The incident highlights the dual risk of website owners failing to secure their CMS platforms and end users lacking awareness of browser-based social engineering tactics. Malware achieving C2 persistence means compromised systems can be leveraged for extended campaigns well beyond the initial infection.
Tactical Insight
Immediate actions
- Audit all website files and server configurations for unauthorized iframe injections or JavaScript modifications.
- Warn users and stakeholders that legitimate Cloudflare or browser verification pages will never ask you to run commands or install software.
- Force-reset credentials for all website administrators and enable multi-factor authentication on CMS platforms immediately.
Long-term improvements
- Implement a Content Security Policy (CSP) header on all web properties to block unauthorized iframe and script injection.
- Enforce regular integrity checks and file-change monitoring on web server directories to detect unauthorized modifications early.
- Conduct recurring security awareness training focused on ClickFix and social engineering lures that impersonate trusted brands.
Detection measures
- Deploy endpoint detection and response (EDR) tools configured to alert on suspicious MSI installer executions initiated from browser processes.
- Monitor outbound network traffic for unexpected C2 communications, particularly to newly registered or low-reputation domains.
- Implement web application firewall (WAF) rules to detect and block malicious script injection patterns targeting your hosted sites.