Forest Global Training Partners

Cyber Risks · The Hacker News

Hacked Ukrainian Sites Serve Fake Cloudflare Click Fix Lures for Psychedelic Stealer

Summary: Arctic Wolf Labs reported an active ClickFix campaign that compromised legitimate Ukrainian business websites, including a hair-treatment clinic, a scale-model manufacturer, and a bookseller, to inject fake Cloudflare verification pages that copy a Windows Installer command to the clipboard and deliver a previously undocumented stealer called Psychedelic. The chain uses an msiexec.exe command to fetch an MSI installer such as elita.msi from uasputnik[.]com, a domain registered on September 9, 2026, which pulls the next-stage payload psychedeliclove.exe from 107.175.82[.]242:9000; the stealer harvests browser passwords, account tokens, and cryptocurrency-wallet data, sets up scheduled-task persistence, and polls a C2 server for tasks. An exposed lure management panel called РУБЛЁВКА TDS recorded 557 views, 426 clicks, and 79 complete events across 32 countries, with Ukraine accounting for 446 views, 351 clicks, and 71 complete events.

Bottom line: The lure's three-second spinner and roughly 35-second disabled Done button are pacing, not verification, so the page cannot tell whether a visitor actually pasted the command, yet 79 people across 32 countries completed the sequence and the panel logged each one in near real time. Russian-language branding and Ukrainian-language instructions point to operators targeting Ukrainian users specifically, and the same ClickFix technique is being used elsewhere to deliver modular malware like RemotePanel and BoundSiphon.

Read the original at The Hacker News ↗

Topics
Malware
Related